@centralu/host-linux-x64 0.1.0-beta.22 → 0.1.0-beta.23

package/host/main.mjs

@@ -42960,12 +42960,12 @@ function refuse(message, io2 = realIo) {
 import { parseArgs } from "node:util";
 import { randomBytes as randomBytes6 } from "node:crypto";
 import { homedir as homedir14, hostname as hostname4 } from "node:os";
-import { dirname as dirname11, join as join33 } from "node:path";
+import { dirname as dirname12, join as join34 } from "node:path";
 import { mkdirSync as mkdirSync11, writeSync as writeSync4 } from "node:fs";
 
 // packages/protocol/src/brand.ts
 var APP_NAME = "Centralu";
-var APP_VERSION = "0.1.0-beta.22";
+var APP_VERSION = "0.1.0-beta.23";
 var APP_SLUG = "centralu";
 var CLIENT_INFO = { name: APP_SLUG, title: APP_NAME, version: APP_VERSION };
 var DATA_DIR = ".centralu";
@@ -43015,6 +43015,13 @@ function split(raw) {
   const pre2 = dash === -1 ? null : v.slice(dash + 1);
   return [core, pre2];
 }
+var LOCAL_BUILD = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*\.local\.[1-9]\d*$/;
+function isLocalBuildVersion(v) {
+  return typeof v === "string" && v.length <= 64 && LOCAL_BUILD.test(v);
+}
+function keepsInstalledCopy(target, copyVersion) {
+  return isLocalBuildVersion(copyVersion) && isNewerVersion(copyVersion, target);
+}
 
 // packages/protocol/src/agent-version.ts
 function parseCliVersion(text2) {
@@ -58020,7 +58027,12 @@ var ApprovalDetail = external_exports.discriminatedUnion("kind", [
     diffPreview: external_exports.string(),
     multi: external_exports.boolean().default(false)
   }),
-  external_exports.object({ kind: external_exports.literal("other"), raw: external_exports.string() }),
+  /**
+   * Anything else, as one text to read. `about` names a card the host raised that a window may know more about
+   * (#665: `centralu_apply`, an agent applying the installed update); a window that does not know it, or predates
+   * the field, reads `raw` as it always has, so the question is the whole of the card in every build.
+   */
+  external_exports.object({ kind: external_exports.literal("other"), raw: external_exports.string(), about: external_exports.string().optional() }),
   external_exports.object({
     kind: external_exports.literal("capability"),
     /** The app trying to use the capability — name is from the manifest */
@@ -58076,7 +58088,11 @@ var ApprovalDetail = external_exports.discriminatedUnion("kind", [
     /** One line for a person to read: the task, cut short */
     text: external_exports.string()
   }),
-  /** An ordinary session asks to check or install Centralu itself (#581). */
+  /**
+   * An ordinary session asks to check or install Centralu itself (#581). Applying the installed build (#665) is not an
+   * action here: a released window parses events strictly and drops one whose enum it does not know, so that card
+   * rides on `other` with `about: 'centralu_apply'`.
+   */
   external_exports.object({
     kind: external_exports.literal("centralu_update"),
     action: external_exports.enum(["check", "install"])
@@ -58101,6 +58117,11 @@ var ApprovalDetail = external_exports.discriminatedUnion("kind", [
     machine: external_exports.string().optional()
   })
 ]);
+var CENTRALU_APPLY = "centralu_apply";
+var CENTRALU_APPLY_QUESTION = "Allow this session to apply the installed Centralu update? The window relaunches into it and running agents keep going. Right after, the new window switches the agent host to the new build: in any session, a Centralu tool call still running after 10 seconds (an agent waiting on its child agents, for one) is stopped and has to be tried again.";
+function isCentraluApply(d2) {
+  return d2.kind === "other" && d2.about === CENTRALU_APPLY;
+}
 var ProjectConsent = external_exports.object({
   fromProjectId: external_exports.string(),
   fromName: external_exports.string(),
@@ -58537,7 +58558,15 @@ var UiPreferences = external_exports.object({
    */
   sessionTools: external_exports.boolean(),
   /** Running children per project: null uses preset defaults (auto unlimited, otherwise 4); 0 is unlimited. */
-  agentCeiling: external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).nullable().optional()
+  agentCeiling: external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).nullable().optional(),
+  /**
+   * The sidebar groups the person folded (#666): the children of a session (`session:<id>`) and the
+   * sessions of an app (`app:<key>`). Only folded groups are listed, so a group nobody touched is
+   * open and an unknown or stale key does nothing. A way of looking, kept with the other screen
+   * preferences so it survives a restart; the patch carries the whole list, since a list cannot be
+   * patched by one entry.
+   */
+  foldedGroups: external_exports.array(external_exports.string().max(300)).max(500)
 });
 var UiPreferencesPatch = UiPreferences.partial();
 var DEFAULT_UI_PREFERENCES = {
@@ -58550,7 +58579,8 @@ var DEFAULT_UI_PREFERENCES = {
   codeFont: "",
   lineHeight: "normal",
   textSize: 1,
-  sessionTools: true
+  sessionTools: true,
+  foldedGroups: []
 };
 function parseUiPreferences(raw) {
   const out = { ...DEFAULT_UI_PREFERENCES };
@@ -58812,7 +58842,17 @@ var NormalizedEvent = external_exports.discriminatedUnion("type", [
    * only came in lists and in answers to the window that woke a session, so another window, or a session woken by the
    * orchestrator or an app, kept showing the old value.
    */
-  external_exports.object({ ...base, type: external_exports.literal("session_live"), live: external_exports.boolean(), reason: external_exports.enum(["asleep"]).optional() }),
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("session_live"),
+    live: external_exports.boolean(),
+    /**
+     * Why the process went away, when `live` is false (#568, #648): `asleep` (an idle session put to sleep),
+     * `restart_failed` (the host replaced the process and the new one did not come up), `crashed` (the process ended
+     * on its own). Absent when `live` is true.
+     */
+    reason: external_exports.enum(["asleep", "restart_failed", "crashed"]).optional()
+  }),
   external_exports.object({
     ...base,
     type: external_exports.literal("usage_update"),
@@ -58982,6 +59022,11 @@ var NormalizedEvent = external_exports.discriminatedUnion("type", [
     verbosity: external_exports.string().nullable(),
     /** Response speed. Follows the same snapshot rule as the three above — optional since old frames lack it */
     serviceTier: external_exports.string().nullable().optional(),
+    /**
+     * The permission preset after the change (#659). A snapshot like the four above; absent on frames that
+     * predate it and on a tool's own switch, which never touches it. The receiving side keeps its value then.
+     */
+    permissionPreset: PermissionPreset.optional(),
     /**
      * Whose hand it was (#304). Absent means the orchestrator, the only author this event had before.
      *
@@ -58992,7 +59037,18 @@ var NormalizedEvent = external_exports.discriminatedUnion("type", [
      * From an adapter, the snapshot is the adapter's own view; the host applies only the fields that differ from what
      * the process was launched with, and re-sends its full snapshot.
      */
-    by: external_exports.enum(["orchestrator", "tool"]).optional()
+    by: external_exports.enum(["orchestrator", "tool"]).optional(),
+    /**
+     * A client changed it through `agents.updateSettings` (#659). The caller already has the answer, but every other
+     * window, linked machine and the person's own window (when an agent made the call) only learns it from this event.
+     * It updates the values shown without the "Orchestrator changed" toast: nobody else's hand was involved, and the
+     * caller's own toast states what it did.
+     *
+     * **A separate flag, not a third `by` word**: a build from before it parses this frame against a `by` enum without
+     * the new word, and a frame that fails to parse is dropped whole. As a flag it is stripped as an unknown key, and
+     * that build still updates the values (and raises one toast, as it did for any change not made by a tool).
+     */
+    person: external_exports.boolean().optional()
   }),
   external_exports.object({ ...base, type: external_exports.literal("history_synced"), added: external_exports.number() }),
   /** The session was deleted — the list must stay correct in other windows and after a reconnect too */
@@ -59052,7 +59108,13 @@ var NormalizedEvent = external_exports.discriminatedUnion("type", [
     type: external_exports.literal("background_tasks"),
     live: external_exports.array(BackgroundTask),
     ended: external_exports.array(BackgroundTask).optional(),
-    clearEnded: external_exports.boolean().optional()
+    clearEnded: external_exports.boolean().optional(),
+    /**
+     * `live` is the tool's own full list of what runs in the process (#648): Claude's `background_tasks_changed`. Only
+     * such a list settles what a process adopted from a previous host holds; a level built from what this host saw
+     * (an ending, a `/loop` timer) does not.
+     */
+    snapshot: external_exports.boolean().optional()
   }),
   /**
    * The version of the agent CLI this session's process runs (#297): Claude's init message (`claude_code_version`), the
@@ -59080,6 +59142,18 @@ var NormalizedEvent = external_exports.discriminatedUnion("type", [
    * the long-running window the schedule was for.
    */
   external_exports.object({ ...appScoped, type: external_exports.literal("update_status"), status: UpdateStatus }),
+  /**
+   * An agent asked to apply the installed update (#665, `update_centralu` action "apply"): each window that hears this
+   * makes the checks its "Apply now" makes and answers with `updates.answerApply`. Nothing relaunches yet; a window
+   * the host picks is told so by `update_apply_go`. A replay of this event after the host stopped asking is answered
+   * with no ticket, so it starts nothing.
+   */
+  external_exports.object({ ...appScoped, type: external_exports.literal("update_apply_request"), requestId: external_exports.string() }),
+  /**
+   * The one window holding `ticket` (from its `updates.answerApply`) relaunches now, through the same path as its
+   * "Apply now" button, and reports with `updates.reportApply`. Every other window ignores it: only one relaunches.
+   */
+  external_exports.object({ ...appScoped, type: external_exports.literal("update_apply_go"), requestId: external_exports.string(), ticket: external_exports.string() }),
   /**
    * An external app's tool call finished (M4 A-4). Deliberately coarse: it never carries what
    * changed, only that the receiving side should refetch. An external app's state lives inside the
@@ -59486,7 +59560,13 @@ var UpdateSettingsParams = external_exports.object({
   verbosity: external_exports.string().nullable().optional(),
   /** Response speed. Same rule — which tiers are supported is stated by the model list */
   serviceTier: external_exports.string().nullable().optional(),
-  permissionPreset: PermissionPreset.optional()
+  permissionPreset: PermissionPreset.optional(),
+  /**
+   * Whose hand makes the call (#659). Absent means a person's client, which is announced without a toast. The
+   * orchestrator's settings tool on a linked machine sends `orchestrator`, so the machine broadcasts the change as the
+   * orchestrator's and the window still toasts it. A host from before this field strips it, and then says nothing.
+   */
+  by: external_exports.literal("orchestrator").optional()
 });
 var SessionKind = external_exports.enum(["worker", "orchestrator", "coordinator"]);
 var SessionInfo = external_exports.object({
@@ -61158,6 +61238,24 @@ var RpcMethods = {
     params: external_exports.object({}),
     result: UpdateStatus
   },
+  /**
+   * A window's answer to `update_apply_request` (#665): whether its "Apply now" could relaunch into the installed build
+   * right now, and why not. The first window that is ready gets a ticket; every other answer, and any answer after the
+   * host stopped asking, gets null.
+   */
+  "updates.answerApply": {
+    params: external_exports.object({ requestId: external_exports.string(), ready: external_exports.boolean(), reason: external_exports.string().optional(), version: external_exports.string().optional() }),
+    result: external_exports.object({ ticket: external_exports.string().nullable() })
+  },
+  /**
+   * The picked window's outcome (#665): `started` right before it relaunches, then with `error` when it did not, or
+   * with neither once the shell accepted the relaunch. A relaunching window may close before that last report; the
+   * host reads its connection ending as the relaunch only after `started`.
+   */
+  "updates.reportApply": {
+    params: external_exports.object({ requestId: external_exports.string(), ticket: external_exports.string(), started: external_exports.boolean().optional(), error: external_exports.string().optional() }),
+    result: external_exports.object({})
+  },
   /**
    * Reads screen settings (UiPreferences).
    *
@@ -62711,6 +62809,10 @@ var HostServer = class _HostServer {
     const frame = `{"kind":"event","seq":${entry.seq},"event":${body}}`;
     for (const ws2 of this.clients) this.sendTo(ws2, frame);
   }
+  /** The connections that said hello with the front door's token: windows, and a hub linked to this host. Never a bridge */
+  get clientCount() {
+    return this.clients.size;
+  }
   /** This host lifetime's id — sent in every `hello_ok` (#82) */
   get streamEpoch() {
     return this.log.streamEpoch;
@@ -63027,15 +63129,15 @@ function buildViewCsp(csp) {
   const frame = sanitizeDomains(csp?.frameDomains);
   const base2 = sanitizeDomains(csp?.baseUriDomains);
   const r = resource.kept.join(" ");
-  const join34 = (...parts) => parts.filter(Boolean).join(" ");
+  const join35 = (...parts) => parts.filter(Boolean).join(" ");
   const policy = [
     "default-src 'none'",
-    `script-src ${join34("'unsafe-inline'", r)}`,
-    `style-src ${join34("'unsafe-inline'", r)}`,
-    `img-src ${join34("data: blob:", r)}`,
-    `font-src ${join34("data:", r)}`,
-    `media-src ${join34("data: blob:", r)}`,
-    `worker-src ${join34("blob:", r)}`,
+    `script-src ${join35("'unsafe-inline'", r)}`,
+    `style-src ${join35("'unsafe-inline'", r)}`,
+    `img-src ${join35("data: blob:", r)}`,
+    `font-src ${join35("data:", r)}`,
+    `media-src ${join35("data: blob:", r)}`,
+    `worker-src ${join35("blob:", r)}`,
     `connect-src ${connect2.kept.length ? connect2.kept.join(" ") : "'none'"}`,
     `frame-src ${frame.kept.length ? frame.kept.join(" ") : "'none'"}`,
     "form-action 'none'",
@@ -64087,6 +64189,13 @@ function installedCopyPath(platform = HOST_PLATFORM, env = process.env, home = h
   }
   return posix2.join(home, ".local/share/applications", `${APP_SLUG}.desktop`);
 }
+function installedCopyVersionSource(copy, platform = HOST_PLATFORM) {
+  if (platform === "darwin") {
+    return { kind: "command", file: "/usr/bin/plutil", args: ["-extract", "CFBundleShortVersionString", "raw", "-o", "-", posix2.join(copy, "Contents", "Info.plist")] };
+  }
+  if (platform === "win32") return { kind: "file", name: "centralu-version.txt" };
+  return null;
+}
 
 // packages/agent-host/src/dev-services/fs.ts
 var MAX_TEXT = 2e6;
@@ -98208,7 +98317,7 @@ var OriginPorts = class {
 // packages/agent-host/src/dev-services/worktree-recovery.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { createReadStream, existsSync as existsSync13 } from "node:fs";
-import { chmod, lstat as lstat3, mkdir as mkdir2, mkdtemp, readFile, readdir as readdir2, realpath as realpath3, rm as rm2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
+import { chmod, lstat as lstat3, mkdir as mkdir2, mkdtemp, readFile, readdir as readdir2, realpath as realpath3, rename as rename2, rm as rm2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join16, resolve as resolve2 } from "node:path";
 var WORKTREE_RECOVERY_MAX_BYTES = 256 * 1024 * 1024;
@@ -98217,8 +98326,51 @@ function worktreeRecoveryDir(sessionId) {
   if (!isSessionId(sessionId)) throw new Error("Invalid session id for worktree recovery");
   return join16(dataRoot(), "worktree-recovery", sessionId);
 }
-async function clearWorktreeRecovery(sessionId) {
-  await rm2(worktreeRecoveryDir(sessionId), { recursive: true, force: true });
+async function stageWorktreeRecoveryRemoval(sessionId) {
+  const dir = worktreeRecoveryDir(sessionId);
+  if (!existsSync13(dir)) return { commit: async () => {
+  }, abort: async () => {
+  } };
+  const staged = `${dir}${PURGING}${randomUUID6()}`;
+  await rename2(dir, staged);
+  return {
+    commit: () => rm2(staged, { recursive: true, force: true, maxRetries: 3 }),
+    abort: () => rename2(staged, dir)
+  };
+}
+var PURGING = ".purging-";
+async function repairWorktreeRecoveryRemovals(trashed) {
+  const root3 = join16(dataRoot(), "worktree-recovery");
+  if (!existsSync13(root3)) return;
+  for (const name of await readdir2(root3)) {
+    const at2 = name.indexOf(PURGING);
+    if (at2 === -1) continue;
+    const sessionId = name.slice(0, at2);
+    if (!isSessionId(sessionId)) continue;
+    const staged = join16(root3, name);
+    try {
+      if (!trashed(sessionId)) {
+        await rm2(staged, { recursive: true, force: true, maxRetries: 3 });
+        continue;
+      }
+      const dir = join16(root3, sessionId);
+      if (!existsSync13(dir)) {
+        await rename2(staged, dir);
+        continue;
+      }
+      for (const snapshot2 of await readdir2(staged)) {
+        if (!existsSync13(join16(dir, snapshot2))) await rename2(join16(staged, snapshot2), join16(dir, snapshot2));
+      }
+      await rm2(staged, { recursive: true, force: true, maxRetries: 3 });
+    } catch (e) {
+      console.error(`[trash] recovery folder ${name} left by an interrupted purge was not repaired, retried at the next start: ${e.message}`);
+    }
+  }
+}
+var MARK = "refs/centralu/recovered/";
+async function clearRecoveredBranchMark(repo, branch) {
+  if (!branch.startsWith("recovered/")) return;
+  await runGit(repo, ["update-ref", "-d", `${MARK}${branch}`]);
 }
 async function* gitRecords(repo, args, input) {
   const dir = await mkdtemp(join16(tmpdir2(), "cc-recovery-git-"));
@@ -98453,11 +98605,37 @@ async function restoreWorktreeRecovery(sessionId, repo, path2, branch, recovery,
   }
   if (!existsSync13(path2)) {
     await rm2(join16(dir, "patches-applied"), { force: true });
-    if (await runGit(repo, ["show-ref", "--verify", `refs/heads/${branch}`]).then(() => true).catch(() => false)) {
-      branch = `recovered/${sessionId}`;
+    const tipOf = (ref) => runGit(repo, ["rev-parse", "--verify", ref]).then((s) => s.trim()).catch(() => null);
+    const createdBy = (ref) => runGit(repo, ["log", "-g", "--format=%gs", ref, "--"]).then((s) => s.trim().split("\n").at(-1) ?? "").catch(() => "");
+    const ours = async (name) => {
+      const existing = await tipOf(`refs/heads/${name}`);
+      if (!existing) return null;
+      if (existing !== recovery.tip || await tipOf(`${MARK}${name}`) !== recovery.tip) return false;
+      const made = await createdBy(`${MARK}${name}`);
+      if (!made.startsWith("centralu recovery ") || made !== await createdBy(`refs/heads/${name}`)) return false;
+      return (await runGit(repo, ["for-each-ref", "--format=%(worktreepath)", `refs/heads/${name}`])).trim() === "";
+    };
+    let create = true;
+    if (await tipOf(`refs/heads/${branch}`)) {
+      const base2 = `recovered/${sessionId}`;
+      branch = base2;
+      for (let suffix = 1; ; suffix++) {
+        const state = await ours(branch);
+        if (state !== false) {
+          create = state === null;
+          break;
+        }
+        branch = `${base2}-${suffix}`;
+      }
     }
     if (root3.bundle) await runGit(repo, ["fetch", join16(dir, "0.bundle"), ...root3.refs ?? ["HEAD"]], { allowRepoPrograms: trust.trusted === true });
-    await runGit(repo, ["worktree", "add", "-b", branch, path2, recovery.tip], { allowRepoPrograms: trust.trusted === true });
+    if (create && branch.startsWith("recovered/")) {
+      const made = `centralu recovery ${randomUUID6()}`;
+      await runGit(repo, ["update-ref", "--create-reflog", "-m", made, `${MARK}${branch}`, recovery.tip]);
+      await runGit(repo, ["update-ref", "--create-reflog", "-m", made, `refs/heads/${branch}`, recovery.tip, ""]);
+      create = false;
+    }
+    await runGit(repo, ["worktree", "add", ...create ? ["-b", branch, path2, recovery.tip] : [path2, branch]], { allowRepoPrograms: trust.trusted === true });
     if (root3.patch || root3.staged) {
       try {
         if (root3.staged) await runGit(path2, ["apply", "--cached", "--binary", join16(dir, "0.staged.patch")]);
@@ -98580,11 +98758,17 @@ Ordinary checks follow npm, including dist-tag rollbacks. Installing reuses a su
 from the last minute or checks again. Only while installing can a higher stored version seen less
 than an hour ago win over the fresh tag. Older observations yield to npm. If the check fails, it
 uses the stored version and says so. Checks preserve install errors until the next install attempt.
+An install asked for with nothing newer known checks first; nothing newer is then "Up to date", not
+a failure. The installed app is replaced by the npm release, even a higher released version, except
+a newer local build (<base>.local.N) waiting to be applied, which is kept; the line says so.
 Once installed, the desktop app offers "Apply now": it relaunches into the new version, and running
 agents, terminals and commands keep going. "Apply updates automatically when idle" (off by default)
 installs a new version without a click and applies it once no session is working or waiting, no
-terminal or command is running, and the person is not typing.
-From the terminal: \`centralu update\`.`
+terminal or command is running, and the person is not typing. An agent can ask for the same Apply now
+(update_centralu, action apply): under auto it applies, under normal the person is asked on a card,
+under safe it is refused, and it never applies what the button would not offer. With it on, a failed install is tried
+again after 10 minutes, then 1 hour, then every 6 hours; the error stays until the next attempt.
+From the terminal: \`centralu update\`. \`centralu install --force\` replaces a kept local build.`
 };
 function gist(description) {
   const first = description.split(/ — |\. /)[0] ?? description;
@@ -98643,8 +98827,8 @@ function trustedJsonText(value) {
 var ORCHESTRATOR_TOOLS = [
   {
     name: "update_centralu",
-    description: "Checks for or installs a Centralu update. Installing never changes the person's automatic-update setting.",
-    schema: external_exports.object({ action: external_exports.enum(["check", "install"]) })
+    description: "Checks for or installs a Centralu update, or applies the installed one (the window relaunches; agents keep running). Never changes the person's automatic-update setting.",
+    schema: external_exports.object({ action: external_exports.enum(["check", "install", "apply"]) })
   },
   {
     name: "list_sessions",
@@ -98782,8 +98966,9 @@ var BUILDER_TOOL_NAMES = ["check"];
 var READER_TOOLS = [
   {
     name: "update_centralu",
+    // "apply" (#665) needs no words of its own here: 8 characters in every reader's request, and the install answer names it
     description: "Updates Centralu with consent.",
-    schema: external_exports.object({ action: external_exports.enum(["check", "install"]) }),
+    schema: external_exports.object({ action: external_exports.enum(["check", "install", "apply"]) }),
     // Updates are rare (#581); keep the definition behind Claude's tool search like app_guide.
     deferred: true
   },
@@ -98943,6 +99128,11 @@ function askProjectText(r) {
 }
 function agentRunText(r) {
   if (!r.ok) return { text: r.error, isError: true };
+  if (r.state === "pending") {
+    return {
+      text: `No session yet: starting ${r.tool} is waiting for the person's answer on the card in your session (request ${r.sessionId}). Carry on with other work, and do not do this with your own subagents instead. If they allow it, the session starts and you will be told when its turn ends; if they refuse or it is withdrawn, you will be told. agent_session(sessionId="${r.sessionId}", action="status") shows where it stands, action="wait" waits for the answer, action="stop" withdraws the request.`
+    };
+  }
   const who = `the ${r.tool} session "${r.sessionName}" [${r.sessionId}]`;
   switch (r.state) {
     case "working":
@@ -98950,6 +99140,7 @@ function agentRunText(r) {
         text: `${who} is working on it${r.notice ? ` \u2014 ${r.notice}` : ""}. ` + (r.reported ? "You will be told when it ends; " : "") + `agent_session(sessionId="${r.sessionId}", action="wait") waits for its answer, action="stop" stops it.`
       };
     case "stopped":
+      if (!r.sessionName) return { text: `Withdrew request ${r.sessionId}: its card is gone and no session was started.` };
       return { text: `Stopped ${who}.` };
     case "deleted":
       if (r.branch === void 0) return { text: `Moved ${who} to the trash. Tell the person in one line.` };
@@ -98975,13 +99166,25 @@ agent_session(sessionId="${r.sessionId}", action="send", text=\u2026) gives it m
 async function runOrchestratorTool(tools, name, args, caller = { sessionId: null, profile: "human" }, signal) {
   if (name === "update_centralu") {
     const action = args.action;
-    if (action !== "check" && action !== "install") return { text: "Give action: check or install.", isError: true };
-    const r = tools.updateCentralu ? await tools.updateCentralu(action) : { ok: false, error: "Update checks are unavailable" };
+    if (action !== "check" && action !== "install" && action !== "apply") return { text: "Give action: check, install or apply.", isError: true };
+    const r = tools.updateCentralu ? await tools.updateCentralu(action, signal) : { ok: false, error: "Update checks are unavailable" };
+    if (action === "apply") {
+      if (!r.ok) return { text: `Centralu update was not applied: ${r.error ?? "unavailable"}`, isError: true };
+      const v = r.relaunched?.version;
+      return {
+        text: `Centralu is relaunching${v ? ` into ${v}` : " into the installed build"}. Running agents, this one included, keep going; the new window then moves the agent host to the new build by itself, and a Centralu tool call still running then may be stopped and need trying again.`
+      };
+    }
     if (!r.ok) return { text: `Centralu update did not start: ${r.error ?? "unavailable"}`, isError: true };
     const s = r.status;
     if (!s) return { text: "Centralu update is unavailable.", isError: true };
     if (action === "check") return { text: s.newer && s.latest ? `Centralu ${s.latest} is available.` : s.error ?? "Centralu is up to date." };
-    return { text: s.phase === "failed" ? `Centralu update failed: ${s.error}` : `Installing Centralu ${s.latest ?? ""}. The person applies the installed build from Centralu; their automatic-update setting was not changed.` };
+    const applies = "The person applies the installed build from Centralu, or update_centralu with action apply does; their automatic-update setting was not changed.";
+    if (s.phase === "failed") return { text: `Centralu update failed: ${s.error}` };
+    if (s.phase === "restart_required") return { text: `Centralu ${s.latest ?? ""} is installed. ${applies}` };
+    if (s.phase === "updating" || s.phase === "waiting_for_npm") return { text: `Installing Centralu ${s.latest ?? ""}. ${applies}` };
+    if (s.newer && s.latest) return { text: `Centralu ${s.latest} is available, but the install did not start.`, isError: true };
+    return { text: s.error ?? "Centralu is up to date." };
   }
   if (name === "list_sessions") return listSessionsText(tools, caller);
   if (name === "centralu_commands" || name === "centralu_help" || name === "centralu_run") return runCommandTool(tools, name, args, caller, signal);
@@ -101161,8 +101364,8 @@ function orchestratorMemory(reader, sessionId) {
 
 // packages/agent-host/src/sessions/manager.ts
 import { homedir as homedir12 } from "node:os";
-import { basename as basename5, isAbsolute as isAbsolute9, join as join29, relative as relative8, resolve as resolve11, sep as sep11 } from "node:path";
-import { existsSync as existsSync19, rmSync as rmSync7, statSync as statSync12 } from "node:fs";
+import { basename as basename5, dirname as dirname10, isAbsolute as isAbsolute9, join as join29, relative as relative8, resolve as resolve11, sep as sep11 } from "node:path";
+import { existsSync as existsSync19, realpathSync as realpathSync8, rmSync as rmSync7, statSync as statSync12 } from "node:fs";
 import { exec as exec6 } from "node:child_process";
 
 // packages/agent-host/src/adapters/claude/index.ts
@@ -102365,6 +102568,28 @@ var ClaudeBackgroundTracker = class {
   recover(messages2) {
     return this.schedules.recover(messages2) ? [this.event()] : [];
   }
+  /**
+   * The tasks the previous host last saw running in an adopted process (#648, `ProcessSource.adopt.backgroundTasks`).
+   * The CLI sends its level only when it changes, so without this a tracker over an adopted process would list nothing
+   * and, since only a task the level once listed counts as background work, report none of their endings either: the
+   * session would read as idle and be put to sleep, or restarted, over a running shell. The manager lists them itself;
+   * this only makes the tracker know them, so the next `task_notification` or level is read against them.
+   */
+  seed(tasks) {
+    for (const t of tasks) {
+      if (t.status !== "running" || t.stoppable === false || this.seen.has(t.id)) continue;
+      this.info.set(t.id, {
+        kind: t.kind,
+        description: t.description,
+        ...t.parentCallId ? { parentCallId: t.parentCallId } : {},
+        ...t.ambient ? { ambient: true } : {},
+        // `entry` derives stopsWithTurn from the kind unless the task is nested; a seeded one without it was nested
+        ...t.stopsWithTurn === void 0 && (t.kind === "agent" || t.kind === "shell") ? { nested: true } : {}
+      });
+      this.live.push(t.id);
+      this.seen.add(t.id);
+    }
+  }
   /** Drops the wake-ups whose time has passed; the new level when that changed anything */
   tick() {
     return this.schedules.prune() ? [this.event()] : [];
@@ -102392,7 +102617,7 @@ var ClaudeBackgroundTracker = class {
         this.live.push(id2);
         this.seen.add(id2);
       }
-      return [this.event()];
+      return [this.event(void 0, true)];
     }
     if (subtype === "task_started" || subtype === "task_updated") {
       const id2 = str4(m.task_id);
@@ -102458,9 +102683,10 @@ var ClaudeBackgroundTracker = class {
       status: "running"
     };
   }
-  event(ended) {
+  event(ended, snapshot2) {
     return {
       type: "background_tasks",
+      ...snapshot2 ? { snapshot: snapshot2 } : {},
       sessionId: this.sessionId,
       live: [...this.live.map((id2) => this.entry(id2, this.info.get(id2))), ...this.schedules.live()],
       ...ended ? { ended } : {}
@@ -103047,6 +103273,7 @@ var ClaudeSession = class {
     this.stream.goal.seed(opts.knownGoal);
     if (opts.processSource?.adopt) this.externalId = opts.resumeExternalId ?? null;
     if (opts.processSource?.adopt && opts.resumeExternalId) void this.recoverSchedules(opts.resumeExternalId, opts.cwd);
+    if (opts.processSource?.adopt?.backgroundTasks?.length) this.stream.tasks.seed(opts.processSource.adopt.backgroundTasks);
   }
   sessionId;
   opts;
@@ -106919,6 +107146,33 @@ function registeredTool(adapters2, preferred) {
   return adapters2.keys().next().value ?? null;
 }
 
+// packages/agent-host/src/sessions/tool-profiles.ts
+function isAppAgent(f) {
+  return !!f.appId && f.kind === "worker" && !RESERVED_APP_IDS.includes(f.appId) && !f.builder;
+}
+function readsOwnProject(f) {
+  return f.kind === "worker" && !!f.projectId && !isAppAgent(f) && f.sessionTools;
+}
+function toolProfileFor(f) {
+  if (f.kind === "orchestrator") return "orchestrator";
+  if (f.kind === "coordinator") return "scoped";
+  if (f.builder) return "builder";
+  return readsOwnProject(f) ? "reader" : null;
+}
+function toolBundleFor(profile, scopeSessionIds, sources) {
+  switch (profile) {
+    case "orchestrator":
+    case "builder":
+      return sources.orchestrator();
+    case "scoped":
+      return sources.scoped(scopeSessionIds ?? []);
+    case "reader":
+      return sources.reader();
+    default:
+      return void 0;
+  }
+}
+
 // packages/agent-host/src/dev-services/store.ts
 import Database from "better-sqlite3";
 import { existsSync as existsSync18, readFileSync as readFileSync12 } from "node:fs";
@@ -108237,6 +108491,70 @@ var Store = class _Store {
              WHERE asked_by_session_id IS NULL AND parent_session_id IS NOT NULL AND worktree_path IS NOT NULL
           `);
         }
+      },
+      {
+        to: 49,
+        breaksOlderReaders: false,
+        /**
+         * "You will be told when it ends" (#646) — `report_marks`, one row per session that owes a report to the session
+         * that gave it work (`start_agent` with `wait: false` or past the bound, `send_to_session` with `reportBack`).
+         *
+         *   session_id         the session whose turn end is reported
+         *   caller_session_id  the session told about it
+         *   marked_at          when the report was asked for
+         *
+         * The mark used to live in the host's memory alone (`SessionManager.awaitingReport`), so a host swap (#280) lost
+         * it: the keeper kept the child's process, it finished under the new host, and the parent was never woken. The
+         * new host reads the rows at startup and keeps the marks of the sessions the keeper kept; a mark whose session
+         * has no process any more is dropped, since the turn it was about died with the old host.
+         *
+         * Not foreign keys: a caller in the trash still has its mark cleared by the manager, and purging either session
+         * deletes the row (`purgeSession`).
+         *
+         * **Expand only (#292's rule).** A new table; an older host never reads it.
+         */
+        run: () => {
+          this.db.exec(`
+            CREATE TABLE IF NOT EXISTS report_marks (
+              session_id        TEXT PRIMARY KEY,
+              caller_session_id TEXT NOT NULL,
+              marked_at         INTEGER NOT NULL
+            )
+          `);
+        }
+      },
+      {
+        to: 50,
+        breaksOlderReaders: false,
+        /**
+         * start_agent requests still waiting for the person (#673) — `agent_start_requests`, one row per consent card
+         * a session raised to start another agent, from the moment the card stands until the person answers it or it is
+         * withdrawn.
+         *
+         *   request_id         the card's request id, which is also the handle the caller follows with agent_session
+         *   caller_session_id  the session that asked
+         *   request            what the start needs once allowed, as JSON (`AgentStartRequest` in the manager)
+         *   asked_at           when the card was raised
+         *
+         * The card used to be withdrawn after 200 seconds, so an absent person never saw it. It now stands until it is
+         * answered, which can outlive the host: a host swap (#280) or a restart reads these rows and raises the cards
+         * again, and an approval starts the child then. A row whose caller is no longer there is dropped.
+         *
+         * Not foreign keys, as `report_marks`: trashing the caller withdraws its rows through the manager, and purging
+         * deletes them (`purgeSession`).
+         *
+         * **Expand only (#292's rule).** A new table; an older host never reads it.
+         */
+        run: () => {
+          this.db.exec(`
+            CREATE TABLE IF NOT EXISTS agent_start_requests (
+              request_id        TEXT PRIMARY KEY,
+              caller_session_id TEXT NOT NULL,
+              request           TEXT NOT NULL,
+              asked_at          INTEGER NOT NULL
+            )
+          `);
+        }
       }
     ];
   }
@@ -108430,11 +108748,16 @@ var Store = class _Store {
     this.checkpoint();
     this.db.close();
   }
+  /**
+   * `trusted` is the trust a NEW row starts with (#655); absent means untrusted, as before. It is an insert-only
+   * value: registering a path that already has a row renames it and leaves its trust alone, so neither an earlier
+   * "no" nor a later "yes" is overwritten by a second registration.
+   */
   addProject(p) {
     this.db.prepare(
-      `INSERT INTO projects (id, path, name, created_at) VALUES (?, ?, ?, ?)
+      `INSERT INTO projects (id, path, name, created_at, trusted) VALUES (?, ?, ?, ?, ?)
          ON CONFLICT(path) DO UPDATE SET name = excluded.name`
-    ).run(p.id, p.path, p.name, Date.now());
+    ).run(p.id, p.path, p.name, Date.now(), p.trusted ? 1 : 0);
   }
   /**
    * `commands` is deliberately not in here (issue #44) — `projectCommands` answers that one.
@@ -109006,6 +109329,8 @@ var Store = class _Store {
       this.db.prepare(`DELETE FROM commit_sessions WHERE session_id = ?`).run(sessionId);
       this.db.prepare(`DELETE FROM app_run_failures WHERE run_id IN (SELECT id FROM app_runs WHERE session_id = ? OR caller_session_id = ?)`).run(sessionId, sessionId);
       this.db.prepare(`DELETE FROM app_runs WHERE session_id = ? OR caller_session_id = ?`).run(sessionId, sessionId);
+      this.db.prepare(`DELETE FROM report_marks WHERE session_id = ? OR caller_session_id = ?`).run(sessionId, sessionId);
+      this.db.prepare(`DELETE FROM agent_start_requests WHERE caller_session_id = ?`).run(sessionId);
       this.db.prepare(`DELETE FROM sessions WHERE id = ? AND deleted_at IS NOT NULL`).run(sessionId);
       return true;
     });
@@ -109593,6 +109918,39 @@ var Store = class _Store {
     ).all();
     return rows.filter((r) => ProjectConsentKind.safeParse(r.kind).success);
   }
+  // ── Sessions that owe a report to the session that gave them work (#646) — see migration v49 ──
+  listReportMarks() {
+    return this.db.prepare(`SELECT session_id as sessionId, caller_session_id as callerSessionId FROM report_marks ORDER BY marked_at`).all();
+  }
+  setReportMark(sessionId, callerSessionId) {
+    this.db.prepare(
+      `INSERT INTO report_marks (session_id, caller_session_id, marked_at) VALUES (?, ?, ?)
+           ON CONFLICT(session_id) DO UPDATE SET caller_session_id = excluded.caller_session_id, marked_at = excluded.marked_at`
+    ).run(sessionId, callerSessionId, Date.now());
+  }
+  clearReportMark(sessionId) {
+    this.db.prepare(`DELETE FROM report_marks WHERE session_id = ?`).run(sessionId);
+  }
+  // ── start_agent requests waiting for the person (#673) — see migration v50 ──
+  listAgentStartRequests() {
+    const rows = this.db.prepare(`SELECT request_id as requestId, caller_session_id as callerSessionId, request, asked_at as askedAt FROM agent_start_requests ORDER BY asked_at`).all();
+    return rows.flatMap((r) => {
+      try {
+        return [{ ...r, request: JSON.parse(r.request) }];
+      } catch {
+        return [];
+      }
+    });
+  }
+  putAgentStartRequest(requestId, callerSessionId, request) {
+    this.db.prepare(
+      `INSERT INTO agent_start_requests (request_id, caller_session_id, request, asked_at) VALUES (?, ?, ?, ?)
+           ON CONFLICT(request_id) DO UPDATE SET caller_session_id = excluded.caller_session_id, request = excluded.request`
+    ).run(requestId, callerSessionId, JSON.stringify(request), Date.now());
+  }
+  deleteAgentStartRequest(requestId) {
+    this.db.prepare(`DELETE FROM agent_start_requests WHERE request_id = ?`).run(requestId);
+  }
   // ── Linked machines (#82, v46) ─────────────────────────────────────────────────────────────
   listLinkedMachines() {
     const rows = this.db.prepare(
@@ -109762,9 +110120,9 @@ async function gitStatusFiles(cwd, trust = {}) {
     if (entry.startsWith("1 ") || entry.startsWith("2 ")) {
       const parts = entry.split(" ");
       const xy = parts[1] ?? "..";
-      const rename5 = entry.startsWith("2 ");
-      const path2 = parts.slice(rename5 ? 9 : 8).join(" ");
-      if (rename5) i++;
+      const rename6 = entry.startsWith("2 ");
+      const path2 = parts.slice(rename6 ? 9 : 8).join(" ");
+      if (rename6) i++;
       if (!path2) continue;
       const [x, y] = [xy[0] ?? ".", xy[1] ?? "."];
       if (x !== ".") out.push({ path: path2, staged: true, status: mapStatus(x) });
@@ -110448,12 +110806,72 @@ function attachCommitSessions(commits, records, nameOf) {
 
 // packages/agent-host/src/sessions/manager.ts
 function withTimeout(p, ms3, label = "A call") {
+  let timer;
   return Promise.race([
     p,
-    new Promise(
-      (_, reject) => setTimeout(() => reject(new Error(`${label} did not finish within ${Math.round(ms3 / 1e3)}s`)), ms3)
-    )
-  ]);
+    new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`${label} did not finish within ${Math.round(ms3 / 1e3)}s`)), ms3);
+    })
+  ]).finally(() => clearTimeout(timer));
+}
+var MODEL_LIST_READ_MS = 6e4;
+var MODEL_LIST_RETRY_MS = 6e4;
+var START_AGENT_MODEL_CHECK_MS = 3e3;
+var START_AGENT_SETUP_MS = 2e5;
+var START_AGENT_CALL_MS = 27e4;
+var ASK_THE_PERSON = "Do not do this with your own subagents instead: tell the person what stopped it and let them decide.";
+var AGENT_DEPTH_ERROR = "This session was itself started or asked by another session, so it cannot start agents \u2014 say in your answer what is needed instead.";
+function readAgentStartRequest(raw) {
+  const r = raw;
+  if (!r || typeof r !== "object") return null;
+  if (typeof r.requestId !== "string" || typeof r.callerId !== "string" || typeof r.projectId !== "string") return null;
+  if (typeof r.tool !== "string" || typeof r.task !== "string" || r.detail?.kind !== "agent_start") return null;
+  return r;
+}
+function agentStartPending(req) {
+  return { ok: true, state: "pending", sessionId: req.requestId, sessionName: "", tool: req.detail.tool };
+}
+function agentStartPersonText(req, how, why) {
+  const what = `The request to start ${req.detail.tool} (\u201C${req.detail.text}\u201D)`;
+  switch (how) {
+    case "denied":
+      return `${what} was denied. The session was told; no agent was started.`;
+    case "cancelled":
+      return `${what} was withdrawn: the call that asked was cancelled before you answered. No agent was started.`;
+    case "deleted":
+      return `${what} was withdrawn: this session was deleted. No agent was started.`;
+    case "stopped":
+      return `${what} was withdrawn by this session. No agent was started.`;
+    case "untrusted":
+      return `${what} was withdrawn: the project is no longer trusted. The session was told; no agent was started.`;
+    case "failed":
+      return `${what} was allowed, but no agent was started: ${(why ?? "").slice(0, 300)}`;
+    default:
+      return `${what} was withdrawn before you answered. No agent was started.`;
+  }
+}
+function startAgentLate(progress) {
+  const seconds = Math.round(START_AGENT_SETUP_MS / 1e3);
+  const note = progress.unchecked ? ` (${progress.unchecked}.)` : "";
+  switch (progress.stage) {
+    case "created":
+      return {
+        ok: false,
+        error: `The session [${progress.childId}] was created, but handing it the task took longer than ${seconds} seconds. Do not start another: agent_session(sessionId="${progress.childId}", action="status") shows where it stands. ${ASK_THE_PERSON}${note}`
+      };
+    case "creating":
+      return {
+        ok: false,
+        error: `Starting the session took longer than ${seconds} seconds and had not finished, so a session may or may not exist. Do not call start_agent again until read_session (without a sessionId) shows whether a new session is there; if one starts, you will be told when it ends. ${ASK_THE_PERSON}${note}`
+      };
+    case "asking":
+      return {
+        ok: false,
+        error: `No session was created: the person did not answer the question in this session within ${seconds} seconds, so it was withdrawn. ${ASK_THE_PERSON}`
+      };
+    default:
+      return { ok: false, error: `No session was created: checking the request took longer than ${seconds} seconds. Try again once; if it repeats, ask the person. ${ASK_THE_PERSON}` };
+  }
 }
 var HISTORY_LIMIT = 200;
 var SYNC_LIMIT = 600;
@@ -110490,10 +110908,26 @@ function isCompactionMarker(row) {
   return row.kind === "marker" && p?.type === "compaction" && !p.failed;
 }
 var inTurn = (state) => state === "working" || state === "waiting_approval";
+var BACKGROUND_UNKNOWN_MAX_MS = 2 * 60 * 60 * 1e3;
+var BACKGROUND_HOLD_MAX_MS = 60 * 60 * 1e3;
+function canonicalPath(path2) {
+  const full = resolve11(path2);
+  try {
+    return realpathSync8.native(full);
+  } catch {
+    const parent = dirname10(full);
+    return parent === full ? full : join29(canonicalPath(parent), basename5(full));
+  }
+}
+function insideFolder(path2, folder) {
+  const rel = relative8(folder, path2);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep11}`) && !isAbsolute9(rel);
+}
 var EXTERNAL_LIST_LIMIT = 200;
 var HOST_READ_MAX_LINES = 200;
 var HOST_RECALL_MAX_HITS = 50;
 var HUB_SENDER = "_hub-orchestrator";
+var HOST_SENDER = "_centralu";
 var builderKey = (ref) => `${ref.projectId ?? "_user"}/${ref.appId}`;
 var APP_BUILDERS_KEY = "apps.builders";
 var SessionManager = class {
@@ -110526,8 +110960,29 @@ var SessionManager = class {
         store2.upsertSession(fixed);
       }
     }
+    for (const mark of store2.listReportMarks()) {
+      const child = this.meta.get(mark.sessionId);
+      const running = keeperOpts.keptSessions?.has(mark.sessionId) && !!child && inTurn(child.state) && this.meta.has(mark.callerSessionId);
+      if (running) {
+        this.awaitingReport.set(mark.sessionId, mark.callerSessionId);
+        continue;
+      }
+      if (child && keeperOpts.keptSessions?.has(mark.sessionId)) {
+        console.error(`[agent-host] report mark dropped: ${mark.sessionId.slice(0, 8)} ended its turn during the swap`);
+      }
+      store2.clearReportMark(mark.sessionId);
+    }
+    for (const row of store2.listAgentStartRequests()) {
+      const req = readAgentStartRequest(row.request);
+      if (!req || req.requestId !== row.requestId || req.callerId !== row.callerSessionId) {
+        store2.deleteAgentStartRequest(row.requestId);
+        continue;
+      }
+      this.resumeAgentStart(req);
+    }
     void this.sweepOrphanHandoffNotes().catch(() => {
     });
+    this.recoveryRepair = repairWorktreeRecoveryRemovals((id2) => store2.isTrashed(id2)).catch((e) => console.error(`[trash] recovery folders left by an interrupted purge were not repaired: ${e.message}`));
     this.nameUnnamedWorktrees();
     for (const pid of new Set(
       [...this.meta.values()].filter((s) => s.worktree && s.projectId).map((s) => s.projectId)
@@ -110598,8 +111053,30 @@ var SessionManager = class {
   cacheLedger = new CacheLedger();
   /** Why a session's process is being restarted, for the cache's rebuild cause; taken when the new process comes up */
   restartReasons = /* @__PURE__ */ new Map();
-  /** Session asked to be reported on completion -> orchestrator to notify (removed once notified) */
+  /**
+   * Session asked to be reported on completion -> orchestrator to notify (removed once notified). Mirrored in the
+   * store's `report_marks` (v49, #646) through `markReport` / `clearReport`, so a host swap (#280) does not lose
+   * "you will be told when it ends": the constructor reads the marks back for the sessions the keeper kept.
+   */
   awaitingReport = /* @__PURE__ */ new Map();
+  /**
+   * `detachAll` is handing the sessions to the next host (#280): the waits it fails are not the end of their turns,
+   * so no report goes out and the marks stay in the store for the host that sees those turns end (#646).
+   */
+  handingOver = false;
+  /**
+   * An auto observer's own mid-turn note (#646), `<observer>><session>` -> the reader its receipt is held on. The
+   * observer's `status` and `wait` read this, never the owner's delegation, until a read takes its settled outcome.
+   */
+  observerNotes = /* @__PURE__ */ new Map();
+  markReport(sessionId, callerId) {
+    this.awaitingReport.set(sessionId, callerId);
+    this.store.setReportMark(sessionId, callerId);
+  }
+  clearReport(sessionId) {
+    if (!this.awaitingReport.delete(sessionId)) return;
+    this.store.clearReportMark(sessionId);
+  }
   /**
    * Session currently being resumed -> its promise.
    *
@@ -110629,9 +111106,31 @@ var SessionManager = class {
   definitionsRestartAfterTurn = /* @__PURE__ */ new Set();
   /** A kept process was started with adapter settings from an older host build (#589). */
   launchSettingsRestartAfterTurn = /* @__PURE__ */ new Set();
+  /** Sessions whose pending launch-settings restart comes from a change of their project's trust (#663): the restart says so */
+  trustRestartNotice = /* @__PURE__ */ new Set();
+  /**
+   * Sessions whose adopted process may hold background work this host knows nothing of (#648) -> when the session was
+   * last heard from. The previous host left no list of it (a build before the list was kept), and the tool says its
+   * level only when it changes. Until the tool's own full list arrives (`snapshot`), the session is never idle
+   * (`sessionIdle`: `background_unknown`), so it is not put to sleep over a shell nobody can see; after
+   * `BACKGROUND_UNKNOWN_MAX_MS` without a word it is taken as holding nothing (`backgroundKnown`). A safety restart does
+   * not wait for it (`applyDeferredRestart`). A fresh process starts known: it holds nothing yet.
+   */
+  backgroundUnknown = /* @__PURE__ */ new Map();
+  /**
+   * A deferred restart that changes nothing about safety, waiting for the session's background work to end (#648) ->
+   * when the wait began, and the timer that applies it anyway `BACKGROUND_HOLD_MAX_MS` later. The entry outlives its
+   * timer until the restart is applied: a timer that fires mid-turn finds the turn running, and the turn's end applies
+   * the restart then, counting from `since` rather than starting a new hour.
+   */
+  backgroundHolds = /* @__PURE__ */ new Map();
   updates = null;
   /** Sessions allowed to update once per host; an "always" answer adds this session only. */
   updateConsents = /* @__PURE__ */ new Set();
+  /** Asking a window to apply the installed update (#665); null on a host with no windows to ask (tests) */
+  updateApply = null;
+  /** Sessions whose "always" covers applying (#665), kept apart from check and install: a relaunch is the person's window */
+  updateApplyConsents = /* @__PURE__ */ new Set();
   /**
    * Where external apps are attached to a session (M4 A-5). It is null on a host with no runtime
    * (most tests), and in that case the session accepts no apps — it is optional, like any other
@@ -110681,6 +111180,21 @@ var SessionManager = class {
    * `readGrants`: a restart asks again. The project-wide always is a stored consent instead.
    */
   agentConsents = /* @__PURE__ */ new Set();
+  /**
+   * start_agent requests whose card stands or stood (#673) — request id -> the request. A card is no longer withdrawn
+   * when the call's bound passes: the call answers "pending" with the request id as a handle, the card stays until the
+   * person answers, and an approval starts the child then. Mirrored in the store's `agent_start_requests` while it
+   * stands, so the next host raises it again (`resumeAgentStart`). Kept after it ends, for agent_session on the handle,
+   * until the caller goes.
+   */
+  agentStarts = /* @__PURE__ */ new Map();
+  /**
+   * Places taken by starts between their ceiling check and the child's delegation (#673 review) — project id -> how
+   * many. Counted by `agentCeilingError` with the running children, so starts at once cannot pass the ceiling together.
+   */
+  agentStartReserved = /* @__PURE__ */ new Map();
+  /** `disposeAll` has begun (#673): a card it withdraws is not the person's answer, and its request stays stored */
+  disposing = false;
   /**
    * What a session may read beyond its folder because another project handed it back (#371 part B) — session id ->
    * resolved paths (files, or output folders). Live only: the grant lasts while this host serves the session, and a
@@ -110733,13 +111247,18 @@ var SessionManager = class {
       { code: "internal" }
     );
   }
-  async addProject(path2) {
+  /**
+   * `trusted` is the trust a project new to this host starts with (#655); registering a folder that is already a
+   * project never changes its trust. Registering an existing folder from the screen leaves it untrusted, as the
+   * person decides; only `createProject` passes it, for a folder it made empty itself.
+   */
+  async addProject(path2, opts = {}) {
     if (!existsSync19(path2) || !statSync12(path2).isDirectory()) {
       throw Object.assign(new Error(`Directory not found: ${path2}`), { code: "internal" });
     }
     const existing = this.store.findProjectByPath(path2);
     const id2 = existing?.id ?? randomUUID10();
-    this.store.addProject({ id: id2, path: path2, name: basename5(path2) });
+    this.store.addProject({ id: id2, path: path2, name: basename5(path2), ...opts.trusted ? { trusted: true } : {} });
     return this.projectInfo(id2, path2);
   }
   /**
@@ -110784,7 +111303,7 @@ var SessionManager = class {
   /**
    * Makes a new project (#515): a folder named `name` in `parent` (this machine's `~/Centralu` when absent), empty, or a
    * clone of `source` made with this machine's git and saved sign-ins, then registers it. Never reuses anything
-   * already there (`projectFolderTarget`). A clone that fails leaves nothing behind: the folder this made is removed
+   * already there (`projectFolderTarget`). An empty folder is registered trusted, a clone untrusted (#655). A clone that fails leaves nothing behind: the folder this made is removed
    * and no project is registered.
    */
   async createProject(name, parent, source) {
@@ -110801,7 +111320,7 @@ var SessionManager = class {
       }
     }
     console.error(`[projects] made ${target.path}`);
-    const info = await this.addProject(target.path);
+    const info = await this.addProject(target.path, { trusted: !source });
     this.emit({ type: "projects_changed" });
     return info;
   }
@@ -110895,13 +111414,29 @@ var SessionManager = class {
   }
   /**
    * Project trust (M4 A-2, plan decision 3). The app runtime reads it fresh from the store every
-   * time, so this only writes it — telling it to rescan is the RPC layer's job (this layer does not
-   * know about the runtime).
+   * time, so telling it to rescan is the RPC layer's job (this layer does not know about the runtime).
+   *
+   * Trust decides which setting files a session reads (Claude `settingSources`, Codex `repoFilesConfig`), and a
+   * live process keeps the ones it started with (#663). The flag is part of the launch-settings fingerprint, so a
+   * change goes through the same safety restart as any other launch-settings change (#656): an idle session of the
+   * project restarts now, one in a turn at the end of the turn, background work or not, and the conversation says
+   * why. The flag is written before this returns; the promise settles when the idle restarts are done.
    */
   setProjectTrusted(projectId, trusted) {
     if (!this.store.setProjectTrusted(projectId, trusted)) {
       throw Object.assign(new Error(`Project not found: ${projectId}`), { code: "internal" });
     }
+    if (!trusted) {
+      for (const rec of [...this.agentStarts.values()]) {
+        if (rec.ended || rec.req.projectId !== projectId) continue;
+        this.withdrawAgentStart(
+          rec.req.requestId,
+          `The person stopped trusting this session's project, so no agent was started. ${ASK_THE_PERSON}`,
+          agentStartPersonText(rec.req, "untrusted")
+        );
+      }
+    }
+    return this.refreshLaunchSettings(projectId, true);
   }
   /**
    * Is this project trusted (decision 3, #92) — passed to the adapter when launching a session. False
@@ -111351,6 +111886,7 @@ var SessionManager = class {
     let handle;
     if (params.builderOf) this.setBuilder(params.builderOf, id2);
     const apps = this.appsFor(info);
+    const profile = toolProfileFor(this.profileFacts(info, !!params.builderOf));
     const from = this.handleSink();
     this.unborn.set(id2, []);
     try {
@@ -111374,14 +111910,14 @@ var SessionManager = class {
           ...this.handoffReadDirs(params.projectId, !!params.handoff?.fromSessionId),
           // Paths another project handed back to this session (#371), asked on every read
           mayRead: (path2) => this.mayRead(id2, path2, cwd),
-          // An orchestrator gets all of them; an ordinary session the reader set (#320, #561). The same rule runs again
-          // on every wake
-          orchestratorTools: info.kind === "orchestrator" ? this.orchestratorToolsFor(id2) : params.builderOf ? this.orchestratorToolsFor(id2) : this.readsOwnProject(info) ? this.readerToolsFor(id2) : void 0,
-          toolProfile: info.kind === "orchestrator" ? "orchestrator" : params.builderOf ? "builder" : this.readsOwnProject(info) ? "reader" : void 0,
+          // An orchestrator gets all of them, a builder session (M4 C-3) just its own app's check (the bundle blocks
+          // the rest), an ordinary session its own project, read-only (#320, #561)
+          orchestratorTools: this.toolBundleOf(id2, profile, info),
+          toolProfile: profile ?? void 0,
           systemPromptAppend: info.kind === "orchestrator" ? orchestratorRole() + this.skillsPrompt() : info.roleAppend ?? void 0,
           // The path back to the host — used by the orchestrator tools' bridge and an external app's bridge
           // (M4 A-5)
-          orchestratorBridge: info.kind === "orchestrator" || params.builderOf || apps || this.readsOwnProject(info) ? this.endpoint?.(id2) ?? void 0 : void 0,
+          orchestratorBridge: profile || apps ? this.endpoint?.(id2) ?? void 0 : void 0,
           // An MCP server the person approved is loaded here as a user-folder app (M4 A-7, decision 4)
           apps,
           // The answer schema an app supplied when it asked for this (M4 D-1) — Claude gets it on this
@@ -111417,6 +111953,7 @@ var SessionManager = class {
       }
     }
     this.handles.set(id2, handle);
+    this.rememberBackgroundTasks(info);
     this.cacheLedger.note(id2, params.resumeExternalId ? "new_process" : "cold_start");
     this.running.set(id2, {
       model: info.model,
@@ -111621,16 +112158,86 @@ var SessionManager = class {
    * The keeper as a `ProcessSource` for one session, when this host runs under one (#280 step 2). `version` is the CLI
    * version a process spawned now is started from, written on its keeper tag (#297).
    */
-  processSourceFor(sessionId, tool, adopt, version2) {
+  processSourceFor(sessionId, tool, adopt, version2, kept) {
     const host = this.keeperOpts.processes;
     if (!host) return {};
     return {
       processSource: {
         spawn: (spec) => host.spawn(sessionId, tool, spec, version2 ?? void 0),
-        ...adopt ? { adopt: { process: adopt, openCalls: this.openToolCalls(sessionId) } } : {}
+        ...adopt ? { adopt: { process: adopt, openCalls: this.openToolCalls(sessionId), backgroundTasks: kept ?? [] } } : {}
       }
     };
   }
+  /**
+   * The running background tasks of a session's process, kept in the store (#648) so the host that adopts the process
+   * after a swap knows what it holds: the tool lists its level only when it changes, and `close()` on a process kills
+   * its shells silently. Written on every change and when a process starts (empty). `null` when no host ever wrote it
+   * for this session, which an adopted process reads as "unknown".
+   */
+  backgroundTasksKey(sessionId) {
+    return `background_tasks:${sessionId}`;
+  }
+  keptBackgroundTasks(sessionId) {
+    const raw = this.store.appSetting(this.backgroundTasksKey(sessionId));
+    if (raw === null) return null;
+    try {
+      const parsed = JSON.parse(raw);
+      return Array.isArray(parsed) ? parsed.filter((t) => t && typeof t.id === "string" && t.status === "running") : [];
+    } catch {
+      return [];
+    }
+  }
+  rememberBackgroundTasks(m) {
+    this.store.setAppSetting(this.backgroundTasksKey(m.id), JSON.stringify(m.backgroundTasks.filter((t) => t.status === "running")));
+  }
+  /** Background work the session's process holds that ending it would end (#648): what its tool listed as running */
+  backgroundRunning(sessionId) {
+    const m = this.meta.get(sessionId);
+    return !!m && liveBackgroundTasks(m.backgroundTasks).length > 0;
+  }
+  /**
+   * Whether what the session's process holds in the background is known (#648). An adopted process with no record is
+   * not, until its tool lists its work; after `BACKGROUND_UNKNOWN_MAX_MS` without a word from the session it is taken
+   * as holding nothing, said in the log, and recorded so the next host does not start from unknown again.
+   */
+  backgroundKnown(sessionId) {
+    const since = this.backgroundUnknown.get(sessionId);
+    if (since === void 0) return true;
+    if (Date.now() - since < BACKGROUND_UNKNOWN_MAX_MS) return false;
+    this.backgroundUnknown.delete(sessionId);
+    console.error(
+      `[sessions] ${sessionId.slice(0, 8)}: no word of its background work since it was adopted, for ${Math.round(BACKGROUND_UNKNOWN_MAX_MS / 36e5)} h; taking it as none`
+    );
+    const m = this.meta.get(sessionId);
+    if (m) this.rememberBackgroundTasks(m);
+    return true;
+  }
+  /** The session's process is gone for good (deleted): nothing of its background work is kept (#648) */
+  forgetBackground(sessionId) {
+    this.backgroundUnknown.delete(sessionId);
+    this.clearBackgroundHold(sessionId);
+    this.store.deleteAppSetting(this.backgroundTasksKey(sessionId));
+  }
+  /**
+   * Says in the conversation that a restart is about to end the session's background work (#648): the tool's own
+   * ending of each task follows in the list, but a person whose dev server stopped should read why where they look.
+   */
+  noticeBackgroundStopped(sessionId, cause2) {
+    const m = this.meta.get(sessionId);
+    if (!m || !this.handles.has(sessionId)) return;
+    const why = cause2 === "launch_settings" ? "changed launch settings" : cause2 === "instructions" ? "changed Centralu tool definitions" : cause2 === "thread_restart" ? "a change of attached apps" : cause2 === "model_change" ? "a model change" : this.running.get(sessionId)?.permissionPreset !== m.permissionPreset ? "a permission change" : "changed settings";
+    const tasks = liveBackgroundTasks(m.backgroundTasks);
+    const text2 = tasks.length > 0 ? `Restarting the agent to apply ${why}. The background work it was running stops with it: ${tasks.map((t) => t.description).join(", ")}. Ask the agent to start it again if you still need it.` : this.backgroundUnknown.has(sessionId) ? `Restarting the agent to apply ${why}. Any background work it started before Centralu was updated (a dev server, a watcher) stops with it; ask the agent to start it again if you still need it.` : null;
+    if (text2) this.onEvent({ type: "notice", sessionId, level: "warning", from: "Centralu", label: "restart", text: text2 });
+  }
+  /** Says in the conversation that the restart in progress applies a change of the project's trust (#663) */
+  noticeTrustRestart(sessionId) {
+    if (!this.trustRestartNotice.delete(sessionId)) return;
+    const m = this.meta.get(sessionId);
+    if (!m || !this.handles.has(sessionId)) return;
+    const text2 = this.projectTrusted(m.projectId) ? "Restarted the agent to apply this project's new trust: it now reads the project's own settings and instruction files (CLAUDE.md, AGENTS.md)." : "Restarted the agent to apply this project's removed trust: it now reads only your own settings, not the project's files.";
+    this.onEvent({ type: "notice", sessionId, level: "info", from: "Centralu", label: "restart", text: text2 });
+  }
   /** Tool calls the store holds for this session with no result after them (the newest 200 rows) */
   openToolCalls(sessionId) {
     const open6 = /* @__PURE__ */ new Map();
@@ -111673,7 +112280,7 @@ var SessionManager = class {
     );
   }
   async doResumeSession(sessionId, adopt) {
-    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
+    if (this.worktreeCleanupBlocks(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (this.handles.has(sessionId)) return { session: m, resumed: true };
@@ -111715,6 +112322,7 @@ var SessionManager = class {
     }
     const apps = this.appsFor(m);
     const builds = this.builderRefOf(m) !== null;
+    const profile = toolProfileFor(this.profileFacts(m, builds));
     const from = this.handleSink();
     const launched = {
       model: m.model,
@@ -111724,12 +112332,13 @@ var SessionManager = class {
       permissionPreset: m.permissionPreset
     };
     if (!adopt) m.agentVersion = this.versionHint?.(tool) ?? null;
+    const kept = adopt ? this.keptBackgroundTasks(sessionId) : null;
     try {
       const creating = adapter.createSession(
         {
           sessionId,
           cwd,
-          ...this.processSourceFor(sessionId, tool, adopt, m.agentVersion),
+          ...this.processSourceFor(sessionId, tool, adopt, m.agentVersion, kept),
           model: launched.model ?? void 0,
           effort: launched.effort ?? void 0,
           verbosity: launched.verbosity ?? void 0,
@@ -111761,11 +112370,8 @@ var SessionManager = class {
            * has just been attached passes this check the next time it wakes and receives the
            * child-only tools and role.
            */
-          orchestratorTools: m.kind === "orchestrator" ? this.orchestratorToolsFor(sessionId) : m.kind === "coordinator" ? this.orchestratorToolsFor(sessionId, m.scopeSessionIds ?? []) : builds ? this.orchestratorToolsFor(sessionId) : (
-            // Every other session: its own project (#320, #561)
-            this.readsOwnProject(m) ? this.readerToolsFor(sessionId) : void 0
-          ),
-          toolProfile: m.kind === "orchestrator" ? "orchestrator" : m.kind === "coordinator" ? "scoped" : builds ? "builder" : this.readsOwnProject(m) ? "reader" : void 0,
+          orchestratorTools: this.toolBundleOf(sessionId, profile, m),
+          toolProfile: profile ?? void 0,
           /*
            * This is **where memory is handed over.** Switching tools breaks externalId, which routes
            * things down this path (a new process), and that is when the past conversation rides along
@@ -111781,7 +112387,7 @@ var SessionManager = class {
             // for a builder session (C-2) even if the app is broken
             m.roleAppend ?? void 0
           ),
-          orchestratorBridge: m.kind === "orchestrator" || m.kind === "coordinator" || builds || apps || this.readsOwnProject(m) ? this.endpoint?.(sessionId) ?? void 0 : void 0,
+          orchestratorBridge: profile || apps ? this.endpoint?.(sessionId) ?? void 0 : void 0,
           // An approved MCP server is a user-folder app — an orchestrator receives those apps right here (M4
           // A-7)
           apps
@@ -111807,6 +112413,8 @@ var SessionManager = class {
       if (!adopt) {
         this.rememberToolPrefix(sessionId);
         this.rememberLaunchSettings(m, cwd);
+        this.backgroundUnknown.delete(sessionId);
+        this.rememberBackgroundTasks(m);
       }
       this.emit({ type: "session_live", sessionId, live: true });
       this.cacheLedger.note(sessionId, this.restartReasons.get(sessionId) ?? "new_process");
@@ -111817,6 +112425,8 @@ var SessionManager = class {
       if (adopt) {
         this.store.upsertSession(m);
         this.emit({ type: "state_change", sessionId, state: m.state, reason: "reattached" });
+        if (kept === null) this.backgroundUnknown.set(sessionId, Date.now());
+        else if (kept.length > 0) this.onEvent({ type: "background_tasks", sessionId, live: kept });
       } else {
         m.state = "idle";
         m.waitingSince = null;
@@ -111862,7 +112472,7 @@ var SessionManager = class {
    * exactly as it was, and only what happens from here on piles up in the copy.
    */
   async forkConversation(sessionId) {
-    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
+    if (this.worktreeCleanupBlocks(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     const source = m.externalId ?? m.importedFrom;
@@ -111916,7 +112526,10 @@ var SessionManager = class {
    */
   async trashSession(sessionId, removeWorktree = false, removeExternal = false, recovery) {
     const pending = this.trashing.get(sessionId);
-    if (pending) return pending;
+    if (pending) {
+      if (recovery) throw Object.assign(new Error("The session is already being deleted without its recovery snapshot"), { code: "internal" });
+      return pending;
+    }
     const deleting = this.trashSessionOnce(sessionId, removeWorktree, removeExternal, recovery);
     this.trashing.set(sessionId, deleting);
     try {
@@ -111950,6 +112563,13 @@ var SessionManager = class {
     }
     this.readGrants.delete(sessionId);
     this.agentConsents.delete(sessionId);
+    for (const rec of [...this.agentStarts.values()]) {
+      if (rec.req.callerId !== sessionId) continue;
+      this.withdrawAgentStart(rec.req.requestId, "The session that asked was deleted.", agentStartPersonText(rec.req, "deleted"));
+      this.agentStarts.delete(rec.req.requestId);
+    }
+    this.updateConsents.delete(sessionId);
+    this.updateApplyConsents.delete(sessionId);
     for (const ask of [...this.hostAsks.values()]) {
       if (ask.sessionId !== sessionId) continue;
       this.hostAsks.delete(ask.requestId);
@@ -111961,14 +112581,18 @@ var SessionManager = class {
       });
       this.handles.delete(sessionId);
     }
+    this.forgetBackground(sessionId);
     this.closeStream(sessionId);
     let project2;
     if (m.projectId) project2 = this.store.listProjects().find((p) => p.id === m.projectId);
     this.running.delete(sessionId);
     this.restartAfterTurn.delete(sessionId);
+    this.trustRestartNotice.delete(sessionId);
     this.prCheckedAt.delete(sessionId);
     this.appsRestartAfterTurn.delete(sessionId);
-    this.awaitingReport.delete(sessionId);
+    this.clearReport(sessionId);
+    for (const [child, caller] of [...this.awaitingReport]) if (caller === sessionId) this.clearReport(child);
+    for (const key of [...this.observerNotes.keys()]) if (key.startsWith(`${sessionId}>`) || key.endsWith(`>${sessionId}`)) this.observerNotes.delete(key);
     this.forgetCommits(sessionId);
     this.meta.delete(sessionId);
     await this.store.trashSession(sessionId, {
@@ -111982,6 +112606,8 @@ var SessionManager = class {
     this.appsHub?.sessionGone(sessionId);
     this.emit({ type: "session_deleted", sessionId });
   }
+  /** The startup repair of recovery folders an interrupted purge left aside (#647) */
+  recoveryRepair = Promise.resolve();
   /** Only one trash operation per session at a time — a purge racing a restore would restore half of a deleted session */
   trashBusy = /* @__PURE__ */ new Set();
   async trashOp(sessionId, run) {
@@ -112046,6 +112672,7 @@ var SessionManager = class {
    */
   async restoreSession(sessionId) {
     return this.trashOp(sessionId, async () => {
+      await this.recoveryRepair;
       const t = this.store.trashedSession(sessionId);
       if (!t) throw Object.assign(new Error(`Not in the trash: ${sessionId}`), { code: "session_not_found" });
       const { record: record2 } = t;
@@ -112102,10 +112729,12 @@ var SessionManager = class {
    * believes 550MB is gone). It is skipped when a live session holds the same conversation (it was pulled back
    * from Past conversations meanwhile): deleting it would take that session's history. Then the worktree, when
    * chosen (a failure does not stop the purge — its folder is plain files the person can still remove). Then our
-   * rows, and last the attachments and the handoff note, which have to outlive the rows that point at them.
+   * rows, and last the recovery files, the attachments and the handoff note, which have to outlive the rows that
+   * point at them.
    */
   async purgeSession(sessionId) {
     return this.trashOp(sessionId, async () => {
+      await this.recoveryRepair;
       const t = this.store.trashedSession(sessionId);
       if (!t) throw Object.assign(new Error(`Not in the trash: ${sessionId}`), { code: "session_not_found" });
       const { session: s, record: record2 } = t;
@@ -112128,8 +112757,16 @@ var SessionManager = class {
         await gitWorktreeRemove(record2.projectPath, s.worktree.path, true).catch(() => {
         });
       }
-      await clearWorktreeRecovery(sessionId);
-      await this.store.purgeSession(sessionId);
+      const recoveryRemoval = await stageWorktreeRecoveryRemoval(sessionId);
+      try {
+        await this.store.purgeSession(sessionId);
+        this.forgetBackground(sessionId);
+      } catch (e) {
+        await recoveryRemoval.abort().catch((cause2) => console.error(`[trash] recovery files of ${sessionId.slice(0, 8)} could not be put back after a failed purge and stay aside until the next start: ${cause2.message}`));
+        throw e;
+      }
+      await recoveryRemoval.commit().catch(() => {
+      });
       await clearAttachments(sessionId).catch(() => {
       });
       if (record2.projectId) await this.sweepOrphanHandoffNotes(record2.projectId).catch(() => {
@@ -112200,8 +112837,8 @@ var SessionManager = class {
     const m = this.meta.get(sessionId);
     return live && m && live.model !== m.model ? "model_change" : void 0;
   }
-  async updateSettings(sessionId, s) {
-    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
+  async updateSettings(sessionId, s, by = "person") {
+    if (this.worktreeCleanupBlocks(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (s.model !== void 0 && s.model !== m.model) this.cacheLedger.note(sessionId, "model_change");
@@ -112214,6 +112851,16 @@ var SessionManager = class {
     if ((s.model !== void 0 || s.effort !== void 0) && m.projectId) {
       this.store.setProjectToolDefaults(m.projectId, m.tool, { model: m.model, effort: m.effort });
     }
+    this.emit({
+      type: "settings_changed",
+      sessionId,
+      model: m.model,
+      effort: m.effort,
+      verbosity: m.verbosity,
+      serviceTier: m.serviceTier,
+      permissionPreset: m.permissionPreset,
+      ...by === "person" ? { person: true } : { by }
+    });
     await this.resuming.get(sessionId)?.catch(() => {
     });
     const handle = this.handles.get(sessionId);
@@ -112296,6 +112943,7 @@ var SessionManager = class {
         }
         const wasBusy = inTurn(m.state);
         this.applyStateHint(e, m);
+        if (this.backgroundUnknown.has(m.id)) this.backgroundUnknown.set(m.id, Date.now());
         if (wasBusy && !inTurn(m.state)) {
           endedTurn = true;
           const ref = this.builderRefOf(m);
@@ -112313,6 +112961,7 @@ var SessionManager = class {
           });
           this.handles.delete(e.sessionId);
           this.running.delete(e.sessionId);
+          this.emit({ type: "session_live", sessionId: e.sessionId, live: false, reason: "crashed" });
         }
       }
     }
@@ -112322,13 +112971,37 @@ var SessionManager = class {
     this.emit(seq != null ? { ...e, seq } : e);
     if (endedTurn && e.sessionId && !run?.tracksInputs) void this.reportBackIfAwaited(e.sessionId, e, run?.completedAnswer);
     if (e.type === "approval_resolved" && e.sessionId) this.raiseHostAsks(e.sessionId);
+    if (endedTurn && e.sessionId && this.meta.get(e.sessionId)?.state !== "error") this.raiseHostAsks(e.sessionId);
     if (endedTurn && e.sessionId) this.forgetCommits(e.sessionId);
     if (endedTurn && e.sessionId) this.applyDeferredRestart(e.sessionId);
+    if (e.type === "background_tasks" && e.sessionId) this.applyDeferredRestart(e.sessionId);
   }
-  /** A note receipt follows turn_complete: re-check the same deferred change when the last hold is released. */
+  /** A queued note not yet taken, on the delegation's wait or an observer's own reader (#646): the session is not between turns */
+  inputsHeld(sessionId) {
+    if (this.agentRuns.get(sessionId)?.waitingForInputs) return true;
+    for (const observer of this.turnObservers.get(sessionId) ?? []) if (observer.waitingForInputs) return true;
+    return false;
+  }
+  /**
+   * A note receipt follows turn_complete: re-check the same deferred change when the last hold is released.
+   *
+   * Background work (#648). A change of safety (the permission preset, the launch settings, the tool definitions a
+   * profile serves) is applied at the end of the turn whatever runs in the background: another turn under the old
+   * policy is worse than a stopped dev server, and the conversation says what stopped (`noticeBackgroundStopped`). Any
+   * other change (a model, an app set) waits while work the tool listed is running, as a sleep does, and is applied
+   * anyway after `BACKGROUND_HOLD_MAX_MS`.
+   */
   applyDeferredRestart(sessionId) {
     const session2 = this.meta.get(sessionId);
-    if (!session2 || inTurn(session2.state) || this.deferredRestarts.has(sessionId) || this.agentRuns.get(sessionId)?.waitingForInputs || !this.restartAfterTurn.delete(sessionId)) return;
+    if (!session2 || inTurn(session2.state) || this.deferredRestarts.has(sessionId) || this.inputsHeld(sessionId) || !this.restartAfterTurn.has(sessionId)) return;
+    const hold = this.backgroundHolds.get(sessionId);
+    const holdExpired = !!hold && Date.now() - hold.since >= BACKGROUND_HOLD_MAX_MS;
+    if (!holdExpired && !this.safetyRestartPending(sessionId) && this.backgroundRunning(sessionId)) {
+      this.holdForBackground(sessionId);
+      return;
+    }
+    this.restartAfterTurn.delete(sessionId);
+    this.clearBackgroundHold(sessionId);
     const apps = this.appsRestartAfterTurn.delete(sessionId);
     const definitions = this.definitionsRestartAfterTurn.delete(sessionId);
     const launchSettings = this.launchSettingsRestartAfterTurn.delete(sessionId);
@@ -112342,6 +113015,28 @@ var SessionManager = class {
     void restarting.catch(() => {
     });
   }
+  /** A deferred restart changes what the process may do (#648): its permission preset, launch settings or tool set */
+  safetyRestartPending(sessionId) {
+    const m = this.meta.get(sessionId);
+    const live = this.running.get(sessionId);
+    return this.launchSettingsRestartAfterTurn.has(sessionId) || this.definitionsRestartAfterTurn.has(sessionId) || !!m && !!live && live.permissionPreset !== m.permissionPreset;
+  }
+  /** Holds a non-safety restart for background work, at most `BACKGROUND_HOLD_MAX_MS` (#648) */
+  holdForBackground(sessionId) {
+    if (this.backgroundHolds.has(sessionId)) return;
+    const timer = setTimeout(() => {
+      console.error(`[sessions] ${sessionId.slice(0, 8)}: a restart waited ${Math.round(BACKGROUND_HOLD_MAX_MS / 6e4)} min for background work; applying it at the next quiet moment`);
+      this.applyDeferredRestart(sessionId);
+    }, BACKGROUND_HOLD_MAX_MS);
+    timer.unref?.();
+    this.backgroundHolds.set(sessionId, { since: Date.now(), timer });
+  }
+  /** The wait is over: the restart was applied, or the session is gone (#648) */
+  clearBackgroundHold(sessionId) {
+    const hold = this.backgroundHolds.get(sessionId);
+    if (hold) clearTimeout(hold.timer);
+    this.backgroundHolds.delete(sessionId);
+  }
   /**
    * Notifies the orchestrator when the work it assigned finishes — **the other half of "one window".**
    *
@@ -112356,8 +113051,8 @@ var SessionManager = class {
    */
   async reportBackIfAwaited(sessionId, ending, answer) {
     const orchestratorId = this.awaitingReport.get(sessionId);
-    if (!orchestratorId) return;
-    this.awaitingReport.delete(sessionId);
+    if (!orchestratorId || this.handingOver) return;
+    this.clearReport(sessionId);
     const target = this.meta.get(sessionId);
     if (!target || !this.meta.has(orchestratorId)) return;
     const project2 = target.projectId ? this.store.listProjects().find((p) => p.id === target.projectId)?.name ?? "(project no longer exists)" : "(none)";
@@ -112462,6 +113157,8 @@ If you need more, you can read that session's recent conversation with read_sess
         break;
       case "background_tasks":
         m.backgroundTasks = applyBackgroundTasks(m.backgroundTasks, e);
+        if (e.snapshot) this.backgroundUnknown.delete(m.id);
+        if (!this.backgroundUnknown.has(m.id)) this.rememberBackgroundTasks(m);
         break;
       case "agent_version":
         m.agentVersion = e.version;
@@ -112700,7 +113397,7 @@ If you need more, you can read that session's recent conversation with read_sess
   async deliver(sessionId, text2, attachments, from, relayed, fromApp, fromAppVia = "inline", sendInput) {
     const restarting = this.deferredRestarts.get(sessionId);
     if (restarting) await restarting;
-    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
+    if (this.worktreeCleanupBlocks(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (!this.handles.has(sessionId)) {
@@ -112711,7 +113408,7 @@ If you need more, you can read that session's recent conversation with read_sess
         });
       }
     }
-    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
+    if (this.worktreeCleanupBlocks(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const h = this.requireHandle(sessionId);
     this.closeStream(sessionId);
     const seq = this.store.nextSeq(sessionId);
@@ -112729,7 +113426,7 @@ If you need more, you can read that session's recent conversation with read_sess
     ]);
     m.lastSeq = seq;
     m.lastReadSeq = seq;
-    if (m.autoNamed && m.name === "New session" && !fromApp) {
+    if (m.autoNamed && m.name === "New session" && !fromApp && !from) {
       m.name = truncate(text2);
       this.emit({ type: "session_title", sessionId, title: m.name, auto: true });
     }
@@ -112766,7 +113463,7 @@ ${attachments.map((a) => `@${a.path}`).join("\n")}` : text2;
    * untouched, and only the tool underneath it is swapped.
    */
   async switchTool(sessionId, tool) {
-    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
+    if (this.worktreeCleanupBlocks(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (m.tool === tool) return { ...m, live: this.handles.has(sessionId) };
@@ -112803,8 +113500,9 @@ ${attachments.map((a) => `@${a.path}`).join("\n")}` : text2;
     const ask = this.hostAsks.get(requestId);
     if (ask && ask.sessionId === sessionId) {
       this.hostAsks.delete(requestId);
-      const keepsAlways = ask.detail.kind === "project_access" || ask.detail.kind === "agent_start" || ask.detail.kind === "centralu_update";
+      const keepsAlways = ask.detail.kind === "project_access" || ask.detail.kind === "agent_start" || ask.detail.kind === "centralu_update" || isCentraluApply(ask.detail);
       const answer = !keepsAlways && decision === "always" ? "allow" : decision;
+      this.restAfterCard(ask);
       this.onEvent({ type: "approval_resolved", sessionId, requestId, decision: answer });
       ask.resolve(ask.detail.kind === "agent_start" && answer === "always" && scope === "project" ? "always_project" : answer);
       const after = this.meta.get(sessionId);
@@ -112980,6 +113678,37 @@ ${attachments.map((a) => `@${a.path}`).join("\n")}` : text2;
    * opens would make that click feel slow.
    */
   modelCache = /* @__PURE__ */ new Map();
+  /** One read of a tool's list at a time: a second asker waits on it instead of starting another tool process */
+  modelFetches = /* @__PURE__ */ new Map();
+  /** When a read last failed, so a caller that cannot wait does not start another one at once (#660) */
+  modelFailures = /* @__PURE__ */ new Map();
+  /**
+   * Reads the list once at a time and **keeps the result whenever it arrives**, also after the caller that asked has
+   * stopped waiting: a Codex list that takes 20 seconds is cached for the next call instead of being thrown away at
+   * the caller's bound and read again from scratch (#660). The read has its own ceiling, so it cannot stay pending
+   * and block every later asker.
+   */
+  fetchModels(tool, adapter) {
+    const running = this.modelFetches.get(tool);
+    if (running) return running;
+    const p = withTimeout(adapter.listModels(), MODEL_LIST_READ_MS, `${tool}'s model list`).then(
+      (models) => {
+        this.modelCache.set(tool, { models, at: Date.now() });
+        this.modelFailures.delete(tool);
+        return models;
+      },
+      (err) => {
+        this.modelFailures.set(tool, Date.now());
+        throw err;
+      }
+    );
+    this.modelFetches.set(tool, p);
+    const clear = () => {
+      if (this.modelFetches.get(tool) === p) this.modelFetches.delete(tool);
+    };
+    p.then(clear, clear);
+    return p;
+  }
   async listModels(tool) {
     const adapter = this.adapters.get(tool);
     if (!adapter?.listModels) {
@@ -112988,13 +113717,40 @@ ${attachments.map((a) => `@${a.path}`).join("\n")}` : text2;
     const hit = this.modelCache.get(tool);
     if (hit && Date.now() - hit.at < 5 * 6e4) return { supported: true, models: hit.models };
     try {
-      const models = await withTimeout(adapter.listModels(), 15e3);
-      this.modelCache.set(tool, { models, at: Date.now() });
+      const models = await withTimeout(this.fetchModels(tool, adapter), 15e3);
       return { supported: true, models };
     } catch (err) {
       return { supported: false, reason: err.message, models: hit?.models ?? [] };
     }
   }
+  /**
+   * The list for checking a choice, **never waiting longer than `ms`** (#660). A list we already have, however old,
+   * answers at once (and an old one is refreshed in the background); otherwise one read is started or joined and
+   * waited on for `ms`. Null when there is no list in time: the caller goes on without checking. A read that fails
+   * is not started again for a minute, so a hung Codex does not get a new tool process on every call.
+   *
+   * `fresh` skips the cached list and reads again: the CLI may have been updated since, so a name the cached list
+   * lacks is not refused on its word alone. `cached` says which kind of list came back.
+   */
+  async modelsWithin(tool, ms3, fresh = false) {
+    const adapter = this.adapters.get(tool);
+    if (!adapter?.listModels) return null;
+    const hit = this.modelCache.get(tool);
+    const stale = !hit || Date.now() - hit.at >= 5 * 6e4;
+    if (hit && !stale && !fresh) return { models: hit.models, cached: true };
+    const failedAt = this.modelFailures.get(tool);
+    const failedRecently = failedAt !== void 0 && Date.now() - failedAt < MODEL_LIST_RETRY_MS && !this.modelFetches.has(tool);
+    if (failedRecently) return hit && !fresh ? { models: hit.models, cached: true } : null;
+    const read = this.fetchModels(tool, adapter);
+    read.catch(() => {
+    });
+    if (hit && !fresh) return { models: hit.models, cached: true };
+    try {
+      return { models: await withTimeout(read, ms3), cached: false };
+    } catch {
+      return null;
+    }
+  }
   /** A project's working directory. Used by the terminal to decide its own key (cwd) */
   cwdOfProject(projectId) {
     return this.cwdOf(projectId);
@@ -113431,13 +114187,14 @@ ${String(stderr).slice(0, 2e3)}`
    * reports background work.
    */
   sessionIdle(sessionId) {
-    if (this.worktreeCleanup.has(sessionId)) return { idle: false, reason: "turn" };
+    if (this.worktreeCleanupBlocks(sessionId)) return { idle: false, reason: "turn" };
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
-    if (this.agentRuns.get(sessionId)?.waitingForInputs) return { idle: false, reason: "turn" };
+    if (this.inputsHeld(sessionId)) return { idle: false, reason: "turn" };
     return sessionIdle(m, {
       running: this.handles.has(sessionId),
-      reportsBackground: !!this.adapters.get(m.tool)?.capabilities.backgroundTasks
+      // An adopted process whose work the previous host did not record is as silent as a tool that cannot report (#648)
+      reportsBackground: !!this.adapters.get(m.tool)?.capabilities.backgroundTasks && this.backgroundKnown(sessionId)
     });
   }
   /**
@@ -113497,7 +114254,7 @@ ${String(stderr).slice(0, 2e3)}`
    * process.
    */
   async restartSession(sessionId, cause2) {
-    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
+    if (this.worktreeCleanupBlocks(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     if (cause2) {
       this.restartReasons.set(sessionId, cause2);
       if (cause2 === "launch_settings") console.error(`[sessions] restarting ${sessionId}: launch settings changed or previously unrecorded`);
@@ -113506,8 +114263,11 @@ ${String(stderr).slice(0, 2e3)}`
     this.appsRestartAfterTurn.delete(sessionId);
     this.definitionsRestartAfterTurn.delete(sessionId);
     this.launchSettingsRestartAfterTurn.delete(sessionId);
+    this.noticeTrustRestart(sessionId);
+    this.clearBackgroundHold(sessionId);
     const h = this.handles.get(sessionId);
     if (h) {
+      this.noticeBackgroundStopped(sessionId, cause2);
       await h.dispose().catch(() => {
       });
       this.stampExternalSynced(sessionId);
@@ -113515,7 +114275,17 @@ ${String(stderr).slice(0, 2e3)}`
       this.running.delete(sessionId);
       this.closeStream(sessionId);
     }
-    return this.resumeSession(sessionId);
+    const dropped = (reason) => {
+      if (!h || this.handles.has(sessionId)) return;
+      console.error(`[sessions] restart of ${sessionId.slice(0, 8)} did not bring a process up: ${reason}`);
+      this.emit({ type: "session_live", sessionId, live: false, reason: "restart_failed" });
+    };
+    const r = await this.resumeSession(sessionId).catch((err) => {
+      dropped(err.message);
+      throw err;
+    });
+    if (!r.resumed) dropped(r.reason ?? "unknown");
+    return r;
   }
   /** The persisted prefix a process was started with. It is separate from SessionInfo: a screen never needs it. */
   toolPrefixKey(sessionId) {
@@ -113587,8 +114357,9 @@ ${String(stderr).slice(0, 2e3)}`
    * environment). The adapter owns the fingerprint; the host only gives it the same safe
    * boundary behaviour as changed tool definitions.
    */
-  async refreshLaunchSettings() {
-    for (const session2 of this.meta.values()) {
+  async refreshLaunchSettings(projectId, trustChange = false) {
+    for (const session2 of [...this.meta.values()]) {
+      if (projectId !== void 0 && session2.projectId !== projectId) continue;
       const cwd = this.store.sessionCwd(session2.id);
       if (!cwd) continue;
       const next = this.launchSettingsFingerprint(session2, cwd);
@@ -113597,6 +114368,7 @@ ${String(stderr).slice(0, 2e3)}`
         this.store.setAppSetting(this.launchSettingsKey(session2.id), next);
         continue;
       }
+      if (trustChange) this.trustRestartNotice.add(session2.id);
       if (inTurn(session2.state)) {
         this.restartAfterTurn.add(session2.id);
         this.launchSettingsRestartAfterTurn.add(session2.id);
@@ -113621,7 +114393,7 @@ ${String(stderr).slice(0, 2e3)}`
     const off = () => !this.uiPreferences().sessionTools;
     const offError = "Turned off in Settings";
     return {
-      updateCentralu: async (action) => off() ? { ok: false, error: offError } : this.updateCentraluAsked(sessionId, action),
+      updateCentralu: async (action, signal) => off() ? { ok: false, error: offError } : this.updateCentraluAsked(sessionId, action, signal),
       listSessions: async () => off() ? [] : view2.listSessions(),
       readSession: async (...a) => off() ? { ok: false, error: offError } : view2.readSession(...a),
       recall: async (...a) => off() ? { hits: [] } : view2.recall(...a),
@@ -113667,7 +114439,7 @@ ${String(stderr).slice(0, 2e3)}`
     );
     const scopeError = (id2) => scopeIds !== void 0 ? `Not a member of this coordinating session: ${id2}` : ownProject ? `Not a session in this project: ${id2}` : hubView ? `Not a session this machine shares: ${id2}` : `Not a session this app manages: ${id2}`;
     return {
-      updateCentralu: async (action) => this.updateCentraluAsked(orchestratorId, action),
+      updateCentralu: async (action, signal) => this.updateCentraluAsked(orchestratorId, action, signal),
       listSessions: async () => {
         const byId = projects();
         const mine = [...this.meta.values()].filter((s) => s.id !== orchestratorId && inScope(s)).map((s) => ({
@@ -113700,15 +114472,7 @@ ${String(stderr).slice(0, 2e3)}`
         const target = this.meta.get(sessionId);
         if (!target || !inScope(target)) return { ok: false, error: scopeError(sessionId) };
         try {
-          const info = await this.updateSettings(sessionId, s);
-          this.emit({
-            type: "settings_changed",
-            sessionId,
-            model: info.model,
-            effort: info.effort,
-            verbosity: info.verbosity,
-            serviceTier: info.serviceTier
-          });
+          const info = await this.updateSettings(sessionId, s, "orchestrator");
           return { ok: true, ...info.applied === "after_turn" ? { deferred: true } : {} };
         } catch (e) {
           return { ok: false, error: e.message };
@@ -113864,8 +114628,8 @@ ${String(stderr).slice(0, 2e3)}`
             sessionId: orchestratorId,
             name: orch?.name ?? "Orchestrator"
           });
-          if (reportBack) this.awaitingReport.set(sessionId, orchestratorId);
-          else if (this.awaitingReport.get(sessionId) === orchestratorId) this.awaitingReport.delete(sessionId);
+          if (reportBack) this.markReport(sessionId, orchestratorId);
+          else if (this.awaitingReport.get(sessionId) === orchestratorId) this.clearReport(sessionId);
           return { ok: true };
         } catch (e) {
           return { ok: false, error: e.message };
@@ -114130,15 +114894,19 @@ ${String(stderr).slice(0, 2e3)}`
     if (boundary) console.error(`[permissions] auto session ${sessionId}: ${boundary} allowed`);
     return true;
   }
-  /** Auto allows and logs; other presets raise a host card, withdrawn if the signal fires. */
-  askHost(sessionId, detail, signal) {
+  /**
+   * Auto allows and logs; other presets raise a host card, withdrawn if the signal fires. `requestId` is given when the
+   * caller tracks the card itself (a start_agent request, #673); `shown` raises one the conversation already records
+   * (a request carried over from the previous host) without recording it again.
+   */
+  askHost(sessionId, detail, signal, card = {}) {
     if (signal?.aborted) return Promise.resolve(null);
     const note = detail.kind === "project_access" && !detail.to.trusted ? " (target not trusted)" : "";
     if (this.autoBoundaryOpen(sessionId, `${detail.kind}${note}`)) return Promise.resolve("allow");
     return new Promise((resolve12) => {
       if (signal?.aborted) return resolve12(null);
-      const requestId = `${detail.kind === "project_access" ? "xp" : detail.kind === "agent_start" ? "ag" : detail.kind === "centralu_update" ? "up" : "mk"}-${randomUUID10()}`;
-      this.hostAsks.set(requestId, { requestId, sessionId, detail, shown: false, resolve: resolve12 });
+      const requestId = card.requestId ?? `${detail.kind === "project_access" ? "xp" : detail.kind === "agent_start" ? "ag" : detail.kind === "centralu_update" || isCentraluApply(detail) ? "up" : "mk"}-${randomUUID10()}`;
+      this.hostAsks.set(requestId, { requestId, sessionId, detail, shown: card.shown ?? false, resolve: resolve12 });
       signal?.addEventListener("abort", () => {
         if (!this.hostAsks.delete(requestId)) return;
         const m = this.meta.get(sessionId);
@@ -114335,17 +115103,20 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     this.delegations.set(key, d2);
     return d2;
   }
-  /** Read an existing turn without claiming it in delegations, agentRuns or the caller's sleep graph. */
-  observeTurn(child, subscribe) {
-    const active = this.agentRuns.get(child.id);
+  /**
+   * Read an existing turn without claiming it in delegations, agentRuns or the caller's sleep graph. With `own`, a
+   * fresh reader even while another caller's wait is active: a note's receipt is held on it, never on that wait (#646).
+   */
+  observeTurn(child, subscribe, own = false) {
+    const active = own ? void 0 : this.agentRuns.get(child.id);
     const shared = active && !active.finished ? active : void 0;
-    const wait = shared ?? new AgentRunWait(
-      () => {
-      },
-      () => child.name,
-      void 0,
-      () => finalAnswer(this.store.loadMessages(child.id, 50))
-    );
+    let answerAfter = this.meta.get(child.id)?.lastSeq ?? 0;
+    const wait = shared ?? new AgentRunWait(() => {
+    }, () => child.name, void 0, own ? () => {
+      const answer = finalAnswer(this.store.loadMessages(child.id, 50).filter((m) => m.seq > answerAfter));
+      answerAfter = this.meta.get(child.id)?.lastSeq ?? answerAfter;
+      return answer;
+    } : () => finalAnswer(this.store.loadMessages(child.id, 50)));
     const project2 = this.store.listProjects().find((p) => p.id === child.projectId);
     const target = { id: child.projectId ?? "", name: project2?.name ?? "", path: this.store.sessionCwd(child.id) ?? project2?.path ?? "" };
     if (!shared && subscribe) {
@@ -114443,7 +115214,8 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
    *   1. Who may: an ordinary session of a trusted project (the rule ask_project and attach_app follow, #382), and
    *      not one that was itself started or asked by another session (`askedBy`): depth one.
    *   2. How many: at most `AGENT_CEILING` children run at once in a project, over all its sessions.
-   *   3. The person's consent (`ensureAgentConsent`): once, always for this session, or always for this project.
+   *   3. The person's consent (`ensureAgentConsent`): the project's trust for a `normal` caller (#673); otherwise a
+   *      card, answered once, always for this session, or always for this project.
    *   4. The child: a visible session in the caller's folder, marked `askedBy` the caller, on the tool, model and
    *      effort asked for (or the project's own, as a session the person opens there), under **the caller's own
    *      permission preset**: never more than the caller has, and nothing the caller can change afterwards.
@@ -114452,49 +115224,184 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
    *      "working" and the caller is told when the turn ends (the reportBack path); agent_session waits again.
    */
   async startAgent(callerId, opts, signal) {
-    const caller = this.meta.get(callerId);
-    if (!caller?.projectId) return { ok: false, error: "This session belongs to no project, so it cannot start agents." };
-    if ((caller.askedBy || [...this.delegations.values()].some((d8) => d8.sessionId === callerId && !d8.agent && !d8.settled)) && !this.autoBoundaryOpen(callerId, "delegation depth")) {
-      return { ok: false, error: "This session was itself started or asked by another session, so it cannot start agents \u2014 say in your answer what is needed instead." };
+    const startedAt = Date.now();
+    const progress = { stage: "checking" };
+    const ctl = new AbortController();
+    const onAbort = () => ctl.abort();
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) ctl.abort();
+    let timer;
+    const late = new Promise((resolve12) => {
+      timer = setTimeout(() => {
+        const standing = progress.stage === "asking" && progress.requestId ? this.agentStarts.get(progress.requestId) : void 0;
+        if (standing && !standing.ended) {
+          standing.detached = true;
+          resolve12(agentStartPending(standing.req));
+          return;
+        }
+        ctl.abort();
+        const d8 = progress.stage === "created" ? progress.d : void 0;
+        if (d8) {
+          const notice2 = [progress.unchecked, this.handles.get(d8.sessionId)?.delegationNotice?.()].filter(Boolean).join("; ");
+          const working = this.agentWorking(d8);
+          resolve12(working.ok && notice2 ? { ...working, notice: [working.notice, notice2].filter(Boolean).join("; ") } : working);
+        } else resolve12(startAgentLate(progress));
+      }, START_AGENT_SETUP_MS);
+    });
+    let set3;
+    const setup = this.setUpAgent(callerId, opts, ctl.signal, progress);
+    try {
+      set3 = await Promise.race([setup, late.then((r) => ({ done: r }))]);
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
     }
+    if ("done" in set3) {
+      void setup.then((r) => {
+        if ("key" in r) this.agentWorking(r.d);
+      }, () => {
+      });
+      return set3.done;
+    }
+    const { key, d: d2, notice } = set3;
+    const left = Math.max(1e3, START_AGENT_CALL_MS - (Date.now() - startedAt));
+    const result = opts.wait === false ? this.agentWorking(d2) : await this.awaitAgent(key, d2, signal, false, Math.min(ASK_WAIT_MS, left));
+    return result.ok && notice ? { ...result, notice: [result.notice, notice].filter(Boolean).join("; ") } : result;
+  }
+  /** Everything start_agent does before it waits on the child's turn (#660); `done` is a final answer, otherwise the child works */
+  async setUpAgent(callerId, opts, signal, progress) {
+    const done = (r5) => ({ done: r5 });
+    const caller = this.meta.get(callerId);
+    if (!caller?.projectId) return done({ ok: false, error: "This session belongs to no project, so it cannot start agents." });
+    if (this.agentDepthBlocked(caller) && !this.autoBoundaryOpen(callerId, "delegation depth")) return done({ ok: false, error: AGENT_DEPTH_ERROR });
     const project2 = this.store.listProjects().find((p) => p.id === caller.projectId);
-    if (!project2) return { ok: false, error: "This session's project is no longer registered." };
+    if (!project2) return done({ ok: false, error: "This session's project is no longer registered." });
     if (project2.trusted !== true && !this.autoBoundaryOpen(callerId, "start in an untrusted project")) {
-      return { ok: false, error: "This session's project is not trusted, so it cannot start agents \u2014 the person can trust it from the project menu." };
+      return done({ ok: false, error: `This session's project is not trusted, so it cannot start agents \u2014 the person can trust it from the project menu. ${ASK_THE_PERSON}` });
     }
+    const waiting = [...this.agentStarts.values()].find(
+      (r5) => !r5.ended && r5.req.callerId === callerId && r5.req.task === opts.task && (!opts.tool || r5.req.tool === opts.tool)
+    );
+    if (waiting) return done(agentStartPending(waiting.req));
     const tool = opts.tool ?? this.firstTool(project2.defaultTool);
-    if (!tool) return { ok: false, error: "No agent adapter is available. Install and configure an agent CLI before starting an agent." };
+    if (!tool) return done({ ok: false, error: "No agent adapter is available. Install and configure an agent CLI before starting an agent." });
     const adapter = this.adapters.get(tool);
-    if (!adapter) return { ok: false, error: `No agent named "${tool}" here. Installed tools: ${[...this.adapters.keys()].join(", ") || "none"}.` };
+    if (!adapter) return done({ ok: false, error: `No agent named "${tool}" here. Installed tools: ${[...this.adapters.keys()].join(", ") || "none"}.` });
     const full = this.agentCeilingError(callerId, project2.id);
-    if (full) return { ok: false, error: full };
+    if (full) return done({ ok: false, error: full });
     const remembered = this.store.projectToolDefaults(project2.id)[tool];
     const model = opts.model ?? remembered?.model ?? void 0;
     const effort = opts.effort ?? (!opts.model || opts.model === remembered?.model ? remembered?.effort ?? void 0 : void 0);
-    const wrong = await this.agentChoiceError(tool, opts.model, opts.effort, model);
-    if (wrong) return { ok: false, error: wrong };
+    const checked = await this.agentChoiceError(tool, opts.model, opts.effort, model);
+    if (checked.error) return done({ ok: false, error: checked.error });
+    const unchecked = checked.unchecked;
+    progress.unchecked = unchecked;
     const found = await adapter.detect();
-    if (!found.installed || !found.loggedIn) return { ok: false, error: `${adapter.descriptor.label} cannot take the task: ${found.detail}` };
+    if (!found.installed || !found.loggedIn) return done({ ok: false, error: `${adapter.descriptor.label} cannot take the task: ${found.detail}. ${ASK_THE_PERSON}` });
     const worktree = opts.worktree || opts.branch ? await this.agentWorktreeBranch(project2, opts) : null;
-    if (worktree && "error" in worktree) return { ok: false, error: worktree.error };
-    const consent = await this.ensureAgentConsent(
-      callerId,
-      {
-        kind: "agent_start",
-        project: { id: project2.id, name: project2.name },
-        tool: adapter.descriptor.label,
-        ...model ? { model } : {},
-        preset: caller.permissionPreset,
-        ...worktree ? { worktree: { branch: worktree.branch } } : {},
-        text: taskLine(opts.task)
-      },
-      signal
-    );
-    if (!consent.ok) return consent;
+    if (worktree && "error" in worktree) return done({ ok: false, error: worktree.error });
+    progress.stage = "asking";
+    const detail = {
+      kind: "agent_start",
+      project: { id: project2.id, name: project2.name },
+      tool: adapter.descriptor.label,
+      ...model ? { model } : {},
+      preset: caller.permissionPreset,
+      ...worktree ? { worktree: { branch: worktree.branch } } : {},
+      text: taskLine(opts.task)
+    };
+    const choice = {
+      tool,
+      ...model ? { model } : {},
+      ...effort ? { effort } : {},
+      ...worktree ? { worktreeBranch: worktree.branch } : {},
+      task: opts.task,
+      ...unchecked ? { unchecked } : {}
+    };
+    let request;
+    const consent = await this.ensureAgentConsent(callerId, detail, signal, (requestId) => {
+      request = { requestId, callerId, projectId: project2.id, ...choice, detail };
+      this.openAgentStart(request);
+      progress.requestId = requestId;
+    });
+    if (!consent.ok) {
+      if (request && consent.why === "withdrawn" && (this.handingOver || this.disposing)) return done(agentStartPending(request));
+      if (request) {
+        const ended = this.agentStarts.get(request.requestId)?.ended;
+        if (ended && "error" in ended) return done({ ok: false, error: ended.error });
+        const how = consent.why === "denied" ? "denied" : signal.aborted ? "cancelled" : "withdrawn";
+        this.endAgentStart(request.requestId, { error: consent.error, person: agentStartPersonText(request, how), denied: consent.why === "denied" });
+      }
+      return done(consent);
+    }
+    if (signal.aborted) {
+      const error51 = "The call was withdrawn before the session was created, so none was.";
+      if (request) this.endAgentStart(request.requestId, { error: error51, person: agentStartPersonText(request, "cancelled") });
+      return done({ ok: false, error: error51 });
+    }
+    const r = await this.createAgentChild(callerId, { id: project2.id, name: project2.name, path: project2.path }, choice, progress, request?.detail.preset);
+    if (request) {
+      if ("key" in r) this.endAgentStart(request.requestId, { childId: r.d.sessionId });
+      else {
+        const error51 = r.done.ok ? "No session was created." : r.done.error;
+        this.endAgentStart(request.requestId, { error: error51, person: agentStartPersonText(request, "failed", error51) });
+      }
+    }
+    return r;
+  }
+  /**
+   * The child itself, once the person (or the project's trust) allowed it (#561, #673): counted again, made in the
+   * caller's folder or a new worktree, named, and given the task. A card may have stood for hours, so what the start
+   * rests on is read again first (#673 review): the caller is still here, its project still trusted, it still may start
+   * agents (depth one), and its preset is no higher than the one the person read on the card (`approvedPreset`).
+   *
+   * **The place is taken before the first wait** (#673 review): the ceiling is checked and a place reserved in one
+   * synchronous step (`agentStartReserved`), held until the child's delegation counts it or the start fails. Checked
+   * and counted on either side of `createSession`, eight calls at once all passed a ceiling of four.
+   */
+  async createAgentChild(callerId, project2, choice, progress, approvedPreset) {
+    const done = (r) => ({ done: r });
+    const caller = this.meta.get(callerId);
+    if (!caller) return done({ ok: false, error: "The session that asked is no longer here." });
+    const now = this.store.listProjects().find((p) => p.id === project2.id);
+    if (!now) return done({ ok: false, error: "This session's project is no longer registered." });
+    const auto = caller.permissionPreset === "auto";
+    if (now.trusted !== true && !auto) {
+      return done({ ok: false, error: `This session's project is no longer trusted, so it cannot start agents. ${ASK_THE_PERSON}` });
+    }
+    if (this.agentDepthBlocked(caller) && !auto) return done({ ok: false, error: AGENT_DEPTH_ERROR });
+    if (approvedPreset && !presetWithin(caller.permissionPreset, approvedPreset)) {
+      return done({
+        ok: false,
+        error: `This session's permissions were raised to ${caller.permissionPreset} after the person allowed a session with ${approvedPreset}, so none was started. Call start_agent again if it is still needed: the person decides on the new permissions. ${ASK_THE_PERSON}`
+      });
+    }
+    const { tool, model, effort, unchecked } = choice;
+    const worktree = choice.worktreeBranch ? { branch: choice.worktreeBranch } : null;
     const fullNow = this.agentCeilingError(callerId, project2.id);
-    if (fullNow) return { ok: false, error: fullNow };
+    if (fullNow) return done({ ok: false, error: fullNow });
+    this.agentStartReserved.set(project2.id, (this.agentStartReserved.get(project2.id) ?? 0) + 1);
+    let reserved = true;
+    const release = () => {
+      if (!reserved) return;
+      reserved = false;
+      const left = (this.agentStartReserved.get(project2.id) ?? 1) - 1;
+      if (left > 0) this.agentStartReserved.set(project2.id, left);
+      else this.agentStartReserved.delete(project2.id);
+    };
+    try {
+      return await this.createReservedChild(callerId, caller, project2, { tool, model, effort, unchecked, task: choice.task }, worktree, progress, release);
+    } finally {
+      release();
+    }
+  }
+  /** The rest of `createAgentChild`, with its place reserved; `release` once the delegation counts the child */
+  async createReservedChild(callerId, caller, project2, choice, worktree, progress, release) {
+    const done = (r) => ({ done: r });
+    const { tool, model, effort, unchecked } = choice;
     const cwd = worktree ? project2.path : this.store.sessionCwd(callerId) ?? caller.worktree?.path ?? project2.path;
     let child;
+    progress.stage = "creating";
     try {
       child = await this.createSession({
         projectId: project2.id,
@@ -114512,21 +115419,24 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
         ...worktree ? { worktree: true, worktreeBranch: worktree.branch, ...caller.worktree ? { worktreeBase: caller.worktree.branch } : {} } : {}
       });
     } catch (e) {
-      return { ok: false, error: `Could not start the session: ${e.message}` };
+      return done({ ok: false, error: `Could not start the session: ${e.message}` });
     }
-    if (!worktree) this.rename(child.id, agentName(opts.task));
+    progress.stage = "created";
+    progress.childId = child.id;
+    if (!worktree) this.rename(child.id, agentName(choice.task));
     const key = `${callerId}>${child.id}`;
     const d2 = this.startDelegation(key, callerId, child.id, { id: project2.id, name: project2.name, path: child.worktree?.path ?? cwd }, true);
+    release();
+    progress.d = d2;
     try {
-      await this.deliver(child.id, agentFrame(labelOf(this.store, caller), opts.task), void 0, { sessionId: callerId, name: labelOf(this.store, caller) }, false);
+      await this.deliver(child.id, agentFrame(labelOf(this.store, caller), choice.task), void 0, { sessionId: callerId, name: labelOf(this.store, caller) }, false);
     } catch (e) {
       this.delegations.delete(key);
       if (this.agentRuns.get(child.id) === d2.wait) this.agentRuns.delete(child.id);
-      return { ok: false, error: `Could not give the task to the new session: ${e.message}` };
+      return done({ ok: false, error: `Could not give the task to the new session: ${e.message}` });
     }
     const notice = this.handles.get(child.id)?.delegationNotice?.();
-    const result = opts.wait === false ? this.agentWorking(d2) : await this.awaitAgent(key, d2, signal);
-    return result.ok && notice ? { ...result, notice: [result.notice, notice].filter(Boolean).join("; ") } : result;
+    return { key, d: d2, notice: [unchecked, notice].filter(Boolean).join("; ") || void 0 };
   }
   /**
    * agent_session (#561): safe/normal work only with their own children; auto opens ownership within the project.
@@ -114542,6 +115452,17 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     if (opts.sessionId === callerId && opts.action !== "status") {
       return { ok: false, error: "agent_session cannot wait on, stop, delete or send to its own calling session." };
     }
+    const request = this.agentStarts.get(opts.sessionId);
+    if (request && request.req.callerId === callerId) {
+      const r = await this.agentStartSession(request, opts.action, signal);
+      if ("ok" in r) return r;
+      opts = { ...opts, sessionId: r.childId, action: r.action };
+    } else if (opts.sessionId.startsWith("ag-") && !this.meta.has(opts.sessionId)) {
+      return {
+        ok: false,
+        error: `No start_agent request ${opts.sessionId} of this session is open here: it ended before Centralu restarted, or it is not this session's. read_session (without a sessionId) lists the sessions.`
+      };
+    }
     const caller = this.meta.get(callerId);
     const child = this.meta.get(opts.sessionId);
     const deletingWithoutWorktree = opts.action === "delete" && !child?.worktree;
@@ -114551,6 +115472,8 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     }
     if (opts.sessionId === callerId) return this.agentAtRest(child);
     const key = `${callerId}>${child.id}`;
+    const note = this.delegations.has(key) ? void 0 : this.observerNotes.get(key);
+    if (note && (opts.action === "status" || opts.action === "wait")) return this.readObserverNote(key, note, opts.action === "wait", signal);
     let d2 = this.delegations.get(key);
     let releaseObservation;
     if (!d2 && this.autoBoundaryOpen(callerId)) {
@@ -114572,7 +115495,7 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
           return d2 ? await this.awaitAgent(key, d2, signal, observing) : this.agentAtRest(child);
         case "stop": {
           if (!d2 || d2.settled) return { ok: false, error: `Nothing you gave "${child.name}" is running.` };
-          if (!observing && this.awaitingReport.get(child.id) === callerId) this.awaitingReport.delete(child.id);
+          if (!observing && this.awaitingReport.get(child.id) === callerId) this.clearReport(child.id);
           d2.stop("the session that started it stopped it", observing);
           await d2.outcome;
           if (!observing) this.delegations.delete(key);
@@ -114607,7 +115530,12 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
             if (!this.adapters.get(child.tool)?.capabilities.midTurnInput || !this.handles.get(child.id)?.sendTracked) {
               return { ok: false, error: `"${child.name}" cannot take messages while working. Wait for it (action "wait") or stop it first.` };
             }
-            const releaseHold = d2.wait.holdInput();
+            const own = observing ? this.observeTurn(child, true, true) : void 0;
+            if (own) void own.run.wait.done.then(own.release, own.release);
+            const record2 = own ? { run: own.run, waiters: 0, told: false } : void 0;
+            if (record2) this.observerNotes.set(key, record2);
+            const wait = own?.run.wait ?? d2.wait;
+            const releaseHold = wait.holdInput();
             const release = () => {
               releaseHold();
               this.applyDeferredRestart(child.id);
@@ -114615,12 +115543,24 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
             try {
               await this.deliver(child.id, text2, void 0, from, false, void 0, "inline", (h, input) => {
                 const fail4 = (e) => {
-                  d2.wait.fail(e);
+                  if (!record2) {
+                    wait.fail(e);
+                    return release();
+                  }
+                  wait.fail(new Error(`your note was not delivered: ${e.message}`));
                   release();
+                  if (!record2.told && !record2.waiters && this.observerNotes.get(key) === record2) {
+                    record2.told = true;
+                    void this.tellNoteRefused(callerId, child.id, e.message);
+                  }
                 };
                 void h.sendTracked(input, { complete: release, fail: fail4 }).then(release, fail4);
               });
             } catch (e) {
+              if (record2) {
+                wait.fail(e);
+                if (this.observerNotes.get(key) === record2) this.observerNotes.delete(key);
+              }
               release();
               return { ok: false, error: `Could not send it: ${e.message}` };
             }
@@ -114651,6 +115591,44 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
       releaseObservation?.();
     }
   }
+  /**
+   * agent_session on a start_agent request's handle (#673). While the card stands: status says so, wait waits for the
+   * person's answer up to the bound, stop (or delete) withdraws the card, send is refused. Once the child started, the
+   * call goes on to that session (a wait that saw it start answers its status, so the call stays inside its bound);
+   * once it ended without one, the reason.
+   */
+  async agentStartSession(rec, action, signal) {
+    const id2 = rec.req.requestId;
+    if (!rec.ended) {
+      if (action === "stop" || action === "delete") {
+        this.withdrawAgentStart(id2, "The session that asked withdrew the request.", agentStartPersonText(rec.req, "stopped"));
+        return { ok: true, state: "stopped", sessionId: id2, sessionName: "", tool: rec.req.detail.tool };
+      }
+      if (action === "send") return { ok: false, error: `No session yet: request ${id2} is still waiting for the person's answer. Send once it has started.` };
+      if (action === "wait") {
+        let timer;
+        let onAbort;
+        await Promise.race([
+          rec.done,
+          new Promise((resolve12) => timer = setTimeout(resolve12, ASK_WAIT_MS)),
+          new Promise((resolve12) => {
+            if (!signal) return;
+            onAbort = resolve12;
+            if (signal.aborted) resolve12();
+            else signal.addEventListener("abort", onAbort, { once: true });
+          })
+        ]);
+        clearTimeout(timer);
+        if (onAbort) signal?.removeEventListener("abort", onAbort);
+        const ended2 = rec.ended;
+        if (ended2 && "childId" in ended2) return { childId: ended2.childId, action: "status" };
+      }
+      if (!rec.ended) return agentStartPending(rec.req);
+    }
+    const ended = rec.ended;
+    if ("error" in ended) return { ok: false, error: `Request ${id2} started no session: ${ended.error}` };
+    return { childId: ended.childId, action };
+  }
   /**
    * The branch a child's new worktree goes on (#561 part 2): the one asked for, checked by git's own rule, or one
    * named from the job (`agentBranch`). Refused before the card when the project is no git repository, so the person
@@ -114663,8 +115641,22 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     if (asked) return await gitValidBranchName(asked) ? { branch: asked } : { error: `Not a valid branch name: ${asked}` };
     return { branch: agentBranch(opts.task, randomUUID10()) };
   }
-  /** Prevent a send/resume from racing the snapshot and worktree removal. */
-  worktreeCleanup = /* @__PURE__ */ new Set();
+  /** Prevent a send/resume from racing the snapshot and worktree removal: the child, by id, and its worktree folder */
+  worktreeCleanup = /* @__PURE__ */ new Map();
+  /**
+   * Whether a cleanup under way holds this session still (#647): the child whose worktree goes, and every session whose
+   * folder is inside that worktree. A helper the child started works there; woken during the snapshot, it would write
+   * into a folder about to be removed. Cheap while no cleanup runs, which is nearly always.
+   */
+  worktreeCleanupBlocks(sessionId) {
+    if (this.worktreeCleanup.size === 0) return false;
+    if (this.worktreeCleanup.has(sessionId)) return true;
+    const cwd = this.store.sessionCwd(sessionId) ?? this.meta.get(sessionId)?.worktree?.path;
+    if (!cwd) return false;
+    const path2 = canonicalPath(cwd);
+    for (const folder of this.worktreeCleanup.values()) if (insideFolder(path2, folder)) return true;
+    return false;
+  }
   /** #608: the parent decides; local work follows the session into the trash in every preset. */
   async cleanUpWorktreeChild(target) {
     if (!target.worktree?.base || !target.projectId) {
@@ -114678,8 +115670,16 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     }
     if (this.resuming.has(target.id) || this.deferredRestarts.has(target.id)) return { ok: false, error: `"${target.name}" is waking or restarting \u2014 wait for it first` };
     if (this.worktreeCleanup.has(target.id)) return { ok: false, error: "This worktree is already being removed" };
-    this.worktreeCleanup.add(target.id);
+    if (this.trashing.has(target.id)) return { ok: false, error: `"${target.name}" is already being deleted; its worktree stays in place` };
+    const occupied = () => {
+      const occupants = this.sessionsInside(target);
+      if (!occupants.length) return null;
+      return { ok: false, error: `${occupants.map((s) => `"${s.name}"`).join(", ")} ${occupants.length === 1 ? "is" : "are"} still in the worktree of "${target.name}" \u2014 delete ${occupants.length === 1 ? "it" : "them"} first` };
+    };
+    const taken = occupied();
+    if (taken) return taken;
     const { branch, path: path2 } = target.worktree;
+    this.worktreeCleanup.set(target.id, canonicalPath(path2));
     try {
       const cwd = this.cwdOf(target.projectId);
       const handle = this.handles.get(target.id);
@@ -114700,7 +115700,11 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
           text: `Local work saved before worktree deletion: ${setAside.changedFiles} uncommitted files, ${setAside.commits} commits not on the trunk. Recovery patches and bundles are at ${worktreeRecoveryDir(target.id)}. Restore from Settings \u2192 Trash or recover these files manually before deleting this session for good.`
         });
       }
+      const appeared = occupied();
+      if (appeared) return appeared;
       await this.trashSession(target.id, false, false, setAside);
+      const appearedSince = occupied();
+      if (appearedSince) return { ok: true, branch, setAside, warning: `The session is in the trash, but worktree ${path2} and branch ${branch} were left: ${appearedSince.error}. Recovery files are at ${worktreeRecoveryDir(target.id)}.` };
       try {
         await gitWorktreeRemove(cwd, path2, true, true);
       } catch (e) {
@@ -114708,6 +115712,8 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
       }
       try {
         await gitBranchDelete(cwd, branch, this.gitTrust(target.projectId));
+        await clearRecoveredBranchMark(cwd, branch).catch(() => {
+        });
       } catch (e) {
         return { ok: true, branch, setAside, warning: `The session is in the trash and its worktree was removed, but branch ${branch} was left: ${e.message}. Recovery files are at ${worktreeRecoveryDir(target.id)}.` };
       }
@@ -114718,12 +115724,27 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
       this.worktreeCleanup.delete(target.id);
     }
   }
+  /**
+   * The other sessions whose folder is inside this worktree (#647): a helper the child started without a worktree of
+   * its own works in the child's. One asleep counts too — after a host swap no session has a process, and a message
+   * wakes it right there. Removing the worktree under it would lose what it writes next, so cleanup is refused.
+   */
+  sessionsInside(target) {
+    const root3 = target.worktree?.path;
+    if (!root3) return [];
+    const folder = canonicalPath(root3);
+    return [...this.meta.values()].filter((s) => {
+      if (s.id === target.id) return false;
+      const cwd = this.store.sessionCwd(s.id) ?? s.worktree?.path;
+      return !!cwd && insideFolder(canonicalPath(cwd), folder);
+    });
+  }
   /** A saved ceiling overrides the caller's preset default: auto unlimited, otherwise AGENT_CEILING. */
   agentCeilingError(callerId, projectId) {
     const configured = this.uiPreferences().agentCeiling;
     const ceiling = configured ?? (this.autoBoundaryOpen(callerId) ? 0 : AGENT_CEILING);
     if (ceiling === 0) return null;
-    const running = [...this.delegations.values()].filter((d2) => d2.agent && !d2.settled && this.meta.get(d2.sessionId)?.projectId === projectId).length;
+    const running = [...this.delegations.values()].filter((d2) => d2.agent && !d2.settled && this.meta.get(d2.sessionId)?.projectId === projectId).length + (this.agentStartReserved.get(projectId) ?? 0);
     if (running < ceiling) return null;
     return `${running} agents started by this project's sessions are already working, the most at once. Wait for one (agent_session, action "wait") or stop one, then try again.`;
   }
@@ -114733,22 +115754,38 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
    * list's ids or labels contain (an alias such as "sonnet") passes, and a tool that cannot list its models passes all.
    */
   async agentChoiceError(tool, askedModel, askedEffort, model) {
-    if (!askedModel && !askedEffort) return null;
-    const { supported, models } = await this.listModels(tool);
-    if (!supported || models.length === 0) return null;
-    const find = (name) => {
-      const n = name.toLowerCase();
-      return models.find((m) => m.id.toLowerCase() === n) ?? models.find((m) => m.id.toLowerCase().includes(n) || m.label.toLowerCase().includes(n));
-    };
-    if (askedModel && !find(askedModel)) return `${tool} has no model "${askedModel}". Its models: ${models.map((m) => m.id).join(", ")}.`;
-    if (askedEffort) {
-      const m = model ? find(model) : models[0];
-      if (m && m.efforts.length > 0 && !m.efforts.includes(askedEffort)) return `${m.id} has no effort "${askedEffort}". Its efforts: ${m.efforts.join(", ")}.`;
+    if (!askedModel && !askedEffort) return { error: null };
+    const adapter = this.adapters.get(tool);
+    if (!adapter?.listModels) return { error: null };
+    const what = [askedModel && `model "${askedModel}"`, askedEffort && `effort "${askedEffort}"`].filter(Boolean).join(" and ");
+    const notChecked = (why) => ({ error: null, unchecked: `${what} not checked: ${why}. If the session's first turn fails on it, start again without it` });
+    const mismatch = (models) => {
+      const find = (name) => {
+        const n = name.toLowerCase();
+        return models.find((m) => m.id.toLowerCase() === n) ?? models.find((m) => m.id.toLowerCase().includes(n) || m.label.toLowerCase().includes(n));
+      };
+      if (askedModel && !find(askedModel)) return `${tool} has no model "${askedModel}". Its models: ${models.map((m) => m.id).join(", ")}.`;
+      if (askedEffort) {
+        const m = model ? find(model) : models[0];
+        if (m && m.efforts.length > 0 && !m.efforts.includes(askedEffort)) return `${m.id} has no effort "${askedEffort}". Its efforts: ${m.efforts.join(", ")}.`;
+      }
+      return null;
+    };
+    let got = await this.modelsWithin(tool, START_AGENT_MODEL_CHECK_MS);
+    if (!got) return notChecked(`${tool}'s model list was not available in time`);
+    if (got.models.length === 0) return notChecked(`${tool} listed no models`);
+    let wrong = mismatch(got.models);
+    if (wrong && got.cached) {
+      got = await this.modelsWithin(tool, START_AGENT_MODEL_CHECK_MS, true);
+      if (!got) return notChecked(`${tool}'s saved model list lacks it and a new one was not available in time`);
+      if (got.models.length === 0) return notChecked(`${tool} listed no models`);
+      wrong = mismatch(got.models);
     }
-    return null;
+    return { error: wrong };
   }
   /** Update grants last only for the calling session on this host; they never change automatic application. */
-  async updateCentraluAsked(sessionId, action) {
+  async updateCentraluAsked(sessionId, action, signal) {
+    if (action === "apply") return this.applyUpdateAsked(sessionId, signal);
     const updates2 = this.updates;
     if (!updates2) return { ok: false, error: "Update checks are unavailable" };
     if (this.toolProfileOf(sessionId) === "reader" && !this.updateConsents.has(sessionId)) {
@@ -114756,19 +115793,71 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
       if (decision === "always") this.updateConsents.add(sessionId);
       else if (decision !== "allow") return { ok: false, error: "The person did not allow this Centralu update. Do not ask again unless they tell you to." };
     }
-    return { ok: true, status: action === "check" ? await updates2.check(true) : updates2.apply() };
+    return { ok: true, status: action === "check" ? await updates2.check(true) : await updates2.apply() };
+  }
+  /**
+   * `update_centralu` action "apply" (#665): a window relaunches into the installed build, as its "Apply now" does.
+   *
+   * By the caller's own preset, read now (as every boundary of #606): `auto` applies at once, `normal` raises a card in
+   * the caller (after a window said it is ready, so "nothing installed" never asks), `safe` is refused, as is an agent an
+   * app started. "Always" on the card covers applying for this session only, apart from check and install. The window
+   * still makes every check its button makes (update-apply.ts), so an agent can only ask for what the person could click.
+   */
+  async applyUpdateAsked(sessionId, signal) {
+    const broker = this.updateApply;
+    if (!broker) return { ok: false, error: "Applying updates is unavailable on this host" };
+    const m = this.meta.get(sessionId);
+    if (!m) return { ok: false, error: "The calling session is gone" };
+    if (this.isAppAgentSession(m)) return { ok: false, error: "An agent an app started cannot apply Centralu updates." };
+    if (m.permissionPreset === "safe") {
+      return {
+        ok: false,
+        error: "This session's preset is safe, which cannot relaunch Centralu. Tell the person the update is ready to apply from the update line; do not ask again unless they tell you to."
+      };
+    }
+    const outcome = await broker.apply(async () => {
+      if (this.updateApplyConsents.has(sessionId)) return null;
+      const decision = await this.askHost(sessionId, { kind: "other", raw: CENTRALU_APPLY_QUESTION, about: CENTRALU_APPLY }, signal);
+      if (decision === "always") this.updateApplyConsents.add(sessionId);
+      else if (decision === null) return "The question to the person was withdrawn before they answered, so nothing was relaunched.";
+      else if (decision !== "allow") return "The person did not allow this session to apply the Centralu update. Do not ask again unless they tell you to.";
+      return null;
+    });
+    if (!outcome.ok) return { ok: false, error: outcome.error };
+    console.error(`[updates] session ${sessionId} applied the installed update: a window is relaunching${outcome.version ? ` into ${outcome.version}` : ""}`);
+    return { ok: true, relaunched: outcome.version ? { version: outcome.version } : {} };
   }
   /**
    * The person's consent for a session to start agents (#561), the first time it does: a card in the caller's approval
    * slot. "Always" is kept for this session while this host serves it; with ⌥ (scope `project`) it is remembered as the
    * project's 'agents' consent, listed in Settings → Permissions with ask_project's pairs and revoked there.
+   *
+   * **Trust is the consent (#673).** A `normal` caller in a trusted project starts agents without a card: the person
+   * already decided about that project when they trusted it (#655), and a card in a session they were not looking at
+   * only made the session work alone. `safe` keeps the card, as it keeps every boundary closed (#606); `auto` opens it.
+   * `onCard` hears the request id before a card is raised, so the request can be kept until the person answers.
    */
-  async ensureAgentConsent(callerId, detail, signal) {
+  async ensureAgentConsent(callerId, detail, signal, onCard) {
     if (this.agentConsents.has(callerId)) return { ok: true };
     if (this.store.getProjectConsent(detail.project.id, detail.project.id, "agents")) return { ok: true };
-    const decision = await this.askHost(callerId, detail, signal);
+    if (this.trustIsAgentConsent(callerId, detail.project.id)) return { ok: true };
+    const requestId = `ag-${randomUUID10()}`;
+    if (this.meta.get(callerId)?.permissionPreset !== "auto") onCard?.(requestId);
+    return this.agentConsentFrom(callerId, detail.project.id, await this.askHost(callerId, detail, signal, { requestId }));
+  }
+  /** Depth one (#561): a session started by another, or handling an ask_project task now, starts no agents */
+  agentDepthBlocked(caller) {
+    return !!caller.askedBy || [...this.delegations.values()].some((d2) => d2.sessionId === caller.id && !d2.agent && !d2.settled);
+  }
+  /** A `normal` caller in a trusted project needs no card to start agents (#673): the project's trust, read now */
+  trustIsAgentConsent(callerId, projectId) {
+    if (this.meta.get(callerId)?.permissionPreset !== "normal") return false;
+    return this.store.listProjects().find((p) => p.id === projectId)?.trusted === true;
+  }
+  /** The person's answer on a start_agent card, as consent (remembered where they chose "always") or a refusal */
+  agentConsentFrom(callerId, projectId, decision) {
     if (decision === "always_project") {
-      this.store.setProjectConsent(detail.project.id, detail.project.id, "agents");
+      this.store.setProjectConsent(projectId, projectId, "agents");
       this.emit({ type: "project_consents_changed" });
       return { ok: true };
     }
@@ -114777,15 +115866,112 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
       return { ok: true };
     }
     if (decision === "allow") return { ok: true };
-    if (decision === "deny") return { ok: false, error: "The person did not allow this session to start another agent. Do not start one again unless they tell you to." };
-    return { ok: false, error: "The question to the person was withdrawn before they answered, so no agent was started." };
+    if (decision === "deny") {
+      return { ok: false, why: "denied", error: `The person did not allow this session to start another agent. Do not start one again unless they tell you to. ${ASK_THE_PERSON}` };
+    }
+    return { ok: false, why: "withdrawn", error: `The question to the person was withdrawn before they answered, so no agent was started. ${ASK_THE_PERSON}` };
+  }
+  /** A start_agent request whose card now stands (#673): kept, in memory and in the store, until it is answered */
+  openAgentStart(req) {
+    let end;
+    const done = new Promise((resolve12) => end = resolve12);
+    const rec = { req, detached: false, done, end };
+    this.agentStarts.set(req.requestId, rec);
+    this.store.putAgentStartRequest(req.requestId, req.callerId, req);
+    return rec;
+  }
+  /**
+   * How a start_agent request ended (#673), once: the row goes, a wait on its handle returns, and unless a session
+   * started, the person is shown why in the caller's session (not only the model, in a tool result). A request whose
+   * call already answered "pending" is told to the caller as a message, since no call is left to answer it.
+   * A refusal the person gave on the card while the call waited needs no line: the card itself says "Denied".
+   */
+  endAgentStart(requestId, ended) {
+    const rec = requestId ? this.agentStarts.get(requestId) : void 0;
+    if (!rec || rec.ended) return;
+    rec.ended = "childId" in ended ? { childId: ended.childId } : { error: ended.error };
+    rec.end();
+    this.store.deleteAgentStartRequest(rec.req.requestId);
+    if ("childId" in ended) return;
+    const { callerId } = rec.req;
+    if (!this.meta.has(callerId)) return;
+    if (!ended.denied || rec.detached) {
+      this.onEvent({ type: "notice", sessionId: callerId, level: "warning", from: "Centralu", label: "agent request", audience: "you", text: ended.person });
+    }
+    if (rec.detached) void this.tellAgentStartEnded(rec.req, ended.error);
+  }
+  /** The caller of a request that already answered "pending" hears how it ended (#673), as a message in its session */
+  async tellAgentStartEnded(req, why) {
+    if (this.handingOver || this.disposing || !this.meta.has(req.callerId)) return;
+    try {
+      await this.deliver(
+        req.callerId,
+        `[Centralu] Your start_agent request ${req.requestId} did not start a session.
+Agent: ${frameField(req.detail.tool)}
+Task: ${frameField(req.detail.text)}
+
+Reason: ${why.slice(0, 600)}`,
+        void 0,
+        { sessionId: HOST_SENDER, name: "Centralu" },
+        false
+      );
+    } catch {
+    }
+  }
+  /**
+   * Withdraws a request's card, when the session that asked withdraws it or is deleted (#673): the card closes, the
+   * request ends with `person` shown, and whatever waits on the card hears no answer.
+   */
+  withdrawAgentStart(requestId, error51, person) {
+    const rec = this.agentStarts.get(requestId);
+    if (!rec || rec.ended) return;
+    this.endAgentStart(requestId, { error: error51, person });
+    const ask = this.hostAsks.get(requestId);
+    if (!ask) return;
+    this.hostAsks.delete(requestId);
+    if (this.meta.get(ask.sessionId)?.pendingApproval?.requestId === requestId) {
+      this.restAfterCard(ask);
+      this.onEvent({ type: "approval_resolved", sessionId: ask.sessionId, requestId, decision: "deny" });
+    }
+    ask.resolve(null);
+  }
+  /**
+   * A request the previous host left standing (#673, `agent_start_requests`): its card is raised again, and an
+   * approval starts the child here, with the report armed, as the call would have. A request whose caller is gone ends.
+   */
+  resumeAgentStart(req) {
+    const caller = this.meta.get(req.callerId);
+    if (!caller) {
+      this.store.deleteAgentStartRequest(req.requestId);
+      return;
+    }
+    const rec = this.openAgentStart(req);
+    rec.detached = true;
+    void (async () => {
+      const decision = await this.askHost(req.callerId, req.detail, void 0, { requestId: req.requestId, shown: true });
+      if (decision === null && (this.handingOver || this.disposing)) return;
+      const consent = this.agentConsentFrom(req.callerId, req.projectId, decision);
+      if (!consent.ok) {
+        this.endAgentStart(req.requestId, { error: consent.error, person: agentStartPersonText(req, consent.why === "denied" ? "denied" : "withdrawn"), denied: consent.why === "denied" });
+        return;
+      }
+      const project2 = this.store.listProjects().find((p) => p.id === req.projectId);
+      const r = project2 ? await this.createAgentChild(req.callerId, { id: project2.id, name: project2.name, path: project2.path }, req, { stage: "creating" }, req.detail.preset) : { done: { ok: false, error: "This session's project is no longer registered." } };
+      if ("key" in r) {
+        this.endAgentStart(req.requestId, { childId: r.d.sessionId });
+        this.agentWorking(r.d);
+      } else {
+        const error51 = r.done.ok ? "No session was created." : r.done.error;
+        this.endAgentStart(req.requestId, { error: error51, person: agentStartPersonText(req, "failed", error51) });
+      }
+    })();
   }
   /**
    * "Working": the caller is told when the turn ends (#561), through the report the orchestrator's reportBack uses, unless
    * a call is waiting on it by then (`awaitAgent` takes the marker down while it waits)
    */
   agentWorking(d2, arm = true, observing = false) {
-    if (arm && !observing) this.awaitingReport.set(d2.sessionId, d2.callerId);
+    if (arm && !observing) this.markReport(d2.sessionId, d2.callerId);
     const notice = d2.notice();
     return {
       ok: true,
@@ -114797,6 +115983,43 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
       ...notice ? { notice } : {}
     };
   }
+  /** An observer's `status` / `wait` on the note it sent (#646): its own reader's outcome, taken once it has settled */
+  async readObserverNote(key, note, wait, signal) {
+    if (!wait && !note.run.settled) return this.agentWorking(note.run, false, true);
+    note.waiters++;
+    let r;
+    try {
+      r = await this.awaitAgent(key, note.run, signal, true);
+    } finally {
+      note.waiters--;
+    }
+    if (note.run.settled) {
+      note.told = true;
+      if (this.observerNotes.get(key) === note) this.observerNotes.delete(key);
+    }
+    return r;
+  }
+  /** The observer's note was refused after its send returned (#646): said in the observer's session, as a report is */
+  async tellNoteRefused(observerId, sessionId, why) {
+    if (this.handingOver || !this.meta.has(observerId)) return;
+    const name = this.meta.get(sessionId)?.name ?? sessionId;
+    try {
+      await this.deliver(
+        observerId,
+        `[Centralu] Your note to another session was not delivered.
+Session: ${frameField(name)}
+id: ${sessionId}
+
+Reason: ${why.slice(0, 600)}
+
+Send it again with agent_session, or read that session's recent conversation with read_session.`,
+        void 0,
+        { sessionId, name },
+        true
+      );
+    } catch {
+    }
+  }
   /** A child with nothing of the caller's running: its last final answer (#561) */
   agentAtRest(child) {
     return {
@@ -114810,12 +116033,12 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     };
   }
   /** Waits on a child's turn up to the bound (#561), like `awaitDelegation`, and reads its outcome for the caller */
-  async awaitAgent(key, d2, signal, observing = false) {
-    if (!observing && this.awaitingReport.get(d2.sessionId) === d2.callerId) this.awaitingReport.delete(d2.sessionId);
+  async awaitAgent(key, d2, signal, observing = false, boundMs = ASK_WAIT_MS) {
+    if (!observing && this.awaitingReport.get(d2.sessionId) === d2.callerId) this.clearReport(d2.sessionId);
     const name = () => this.meta.get(d2.sessionId)?.name ?? d2.sessionId;
     let timer;
     let onAbort;
-    const bound = new Promise((resolve12) => timer = setTimeout(() => resolve12("bound"), ASK_WAIT_MS));
+    const bound = new Promise((resolve12) => timer = setTimeout(() => resolve12("bound"), boundMs));
     const aborted2 = new Promise((resolve12) => {
       if (!signal) return;
       onAbort = () => resolve12("aborted");
@@ -114918,6 +116141,7 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     const next = [...this.hostAsks.values()].find((a) => a.sessionId === sessionId);
     if (!next) return;
     const e = { type: "approval_request", sessionId, requestId: next.requestId, detail: next.detail };
+    next.restState = next.shown && !inTurn(m.state) ? m.state : void 0;
     if (!next.shown) {
       next.shown = true;
       this.onEvent(e);
@@ -114927,6 +116151,19 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     this.store.upsertSession(m);
     this.emit(e);
   }
+  /**
+   * A host card raised between turns closes back into that rest (#673), not into "working": no tool call is waiting on
+   * it, so nothing would ever end that turn. Set before the card's `approval_resolved`, which then changes no state, and
+   * without `onEvent`, since no turn ended (no report, no deferred restart).
+   */
+  restAfterCard(ask) {
+    const m = this.meta.get(ask.sessionId);
+    if (!ask.restState || m?.pendingApproval?.requestId !== ask.requestId) return;
+    const e = { type: "state_change", sessionId: ask.sessionId, state: ask.restState };
+    this.applyStateHint(e, m);
+    this.store.upsertSession(m);
+    this.emit(e);
+  }
   /** Screen-originated capability questions still awaiting an answer (M4 D-4) */
   appQuestionList() {
     return [...this.appQuestions.values()].map((x) => ({ ...x.question })).sort((a, b2) => a.askedAt - b2.askedAt);
@@ -115169,8 +116406,7 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     if (!profileAllows(profile, name)) {
       throw Object.assign(new Error(`Not a tool of this session: ${name}`), { code: "internal" });
     }
-    const tools = profile === "scoped" ? this.orchestratorToolsFor(sessionId, m.scopeSessionIds ?? []) : profile === "reader" ? this.readerToolsFor(sessionId) : this.orchestratorToolsFor(sessionId);
-    return runOrchestratorTool(tools, name, args, { sessionId, profile });
+    return runOrchestratorTool(this.toolBundleOf(sessionId, profile, m), name, args, { sessionId, profile });
   }
   /**
    * Receives the external app runtime (M4 A-5) — a session that comes up after this receives whatever
@@ -115188,6 +116424,10 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
   useUpdates(updates2) {
     this.updates = updates2;
   }
+  /** The windows' "Apply now" for an agent (#665, update-apply.ts) — wired by the host, which owns the event stream */
+  useUpdateApply(broker) {
+    this.updateApply = broker;
+  }
   /**
    * Says in the conversation that the session moved to a newer CLI (#297): restarting a process by itself is never
    * silent. A notice from Centralu, not from the tool, so it reads as what happened rather than as something to fix.
@@ -115332,41 +116572,33 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     if (this.isAppAgentSession(m)) return void 0;
     return this.appsHub?.attach({ id: m.id, kind: m.kind, projectId: m.projectId, builderOf: this.builderRefOf(m) }) ?? void 0;
   }
+  /** Is this an agent session stood up at an external app's request (M4 D-1; `isAppAgent` in tool-profiles.ts) */
+  isAppAgentSession(m) {
+    return isAppAgent({ kind: m.kind, appId: m.appId ?? null, builder: this.builderRefOf(m) !== null });
+  }
   /**
-   * Is this an agent session stood up at an external app's request (M4 D-1) — one of the workers an
-   * external app owns (`appId`) that is not that app's own builder session. No separate marker exists
-   * for this: ownership (`appId`) and the builder directory already say it. A row stamped with a
-   * reserved id belongs to the removed control app (#372), never to an external app.
+   * What the profile rule (tool-profiles.ts) reads about this session: its row, whether its app's builder
+   * slot points at it (looked up unless the caller just wrote it), and the Settings switch (#320) as it is
+   * right now.
    */
-  isAppAgentSession(m) {
-    return !!m.appId && m.kind === "worker" && !RESERVED_APP_IDS.includes(m.appId) && this.builderRefOf(m) === null;
+  profileFacts(m, builder = this.builderRefOf(m) !== null) {
+    return { kind: m.kind, projectId: m.projectId, appId: m.appId ?? null, builder, sessionTools: this.uiPreferences().sessionTools };
   }
   /**
-   * The tool bundle this session receives (#69). null means no tools.
-   * Whether something is a manager comes down to a single relationship: if it has a worktree child, it
-   * is a manager (including an archived child — tools are not dangerous, and a manager created through
-   * adoption must still be able to propose things after its children are cleaned up).
+   * The tool bundle this session receives (#69). null means no tools. The rule is `toolProfileFor`
+   * (tool-profiles.ts); creation and every wake hand the adapter the same answer, and the bridge asks
+   * here on every call.
    */
   toolProfileOf(sessionId) {
     const m = this.meta.get(sessionId);
-    if (!m) return null;
-    if (m.kind === "orchestrator") return "orchestrator";
-    if (m.kind === "coordinator") return "scoped";
-    if (this.builderRefOf(m)) return "builder";
-    return this.readsOwnProject(m) ? "reader" : null;
+    return m ? toolProfileFor(this.profileFacts(m)) : null;
   }
-  /**
-   * Does this ordinary session get the light, read-only set (#320)? On unless the person turned it off
-   * in Settings, and never for an agent session an app stood up (M4 D-1): that agent hands its answer
-   * back to the app, so reading the project's conversations would carry them out to an app that was
-   * never given them (the same reason it gets no apps, appsFor).
-   *
-   * The schemas are attached when the session starts, like every other bundle; turning the setting off
-   * stops the calls at once (readerToolsFor and the bridge both ask again) and takes the schemas away
-   * the next time the session starts.
-   */
-  readsOwnProject(m) {
-    return m.kind === "worker" && !!m.projectId && !this.isAppAgentSession(m) && this.uiPreferences().sessionTools;
+  toolBundleOf(sessionId, profile, m) {
+    return toolBundleFor(profile, m.scopeSessionIds, {
+      orchestrator: () => this.orchestratorToolsFor(sessionId),
+      scoped: (ids) => this.orchestratorToolsFor(sessionId, ids),
+      reader: () => this.readerToolsFor(sessionId)
+    });
   }
   /**
    * A profile that directs other sessions — every profile but the reader. The reader set (#320)
@@ -115610,6 +116842,7 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
     );
   }
   async disposeAll() {
+    this.disposing = true;
     this.watchers.close();
     for (const readers of this.turnObservers.values()) for (const observer of readers) observer.fail(new Error("Centralu is stopping"));
     this.appsHub?.rt.attachBrokerHost(null);
@@ -115641,6 +116874,7 @@ ${list()}` : `${target.name} has no ordinary session. The person has to open one
   async detachAll() {
     this.watchers.close();
     this.appsHub?.rt.attachBrokerHost(null);
+    this.handingOver = true;
     for (const run of [...this.agentRuns.values()]) run.fail(new Error("Centralu is restarting"));
     for (const readers of this.turnObservers.values()) for (const observer of readers) observer.fail(new Error("Centralu is restarting"));
     for (const ask of [...this.hostAsks.values()]) ask.resolve(null);
@@ -115674,7 +116908,7 @@ import { relative as relative9 } from "node:path";
 // packages/agent-host/src/themes.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { watch as watch2 } from "node:fs";
-import { mkdir as mkdir7, readdir as readdir9, readFile as readFile5, rename as rename4, stat as stat6, unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir7, readdir as readdir9, readFile as readFile5, rename as rename5, stat as stat6, unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
 import { basename as basename6, join as join30 } from "node:path";
 var MAX_FILE_BYTES = 256 * 1024;
 var SETTLE_MS = 100;
@@ -115788,7 +117022,7 @@ var ThemeFiles = class {
     const tmp = `${path2}.${randomBytes4(6).toString("hex")}.tmp`;
     try {
       await writeFile5(tmp, text2, "utf8");
-      await rename4(tmp, path2);
+      await rename5(tmp, path2);
     } catch (e) {
       await unlink2(tmp).catch(() => {
       });
@@ -115799,7 +117033,7 @@ var ThemeFiles = class {
 
 // packages/agent-host/src/dev-services/strays.ts
 import { execFile as execFile7 } from "node:child_process";
-import { realpathSync as realpathSync8 } from "node:fs";
+import { realpathSync as realpathSync9 } from "node:fs";
 import { promisify as promisify7 } from "node:util";
 import { userInfo } from "node:os";
 var exec7 = promisify7(execFile7);
@@ -115910,7 +117144,7 @@ function resolveRoots(roots) {
   for (const r of roots) {
     out.add(r);
     try {
-      out.add(realpathSync8(r));
+      out.add(realpathSync9(r));
     } catch {
     }
   }
@@ -116023,7 +117257,7 @@ var toInfo = (h) => ({
 function sessionIdsOf(panels) {
   return panels.flatMap((p) => p.kind === "session" ? [p.sessionId] : []);
 }
-function createRpcHandler(mgr2, adapters2, { terminals: terminals2, updates: updates2, commands, externalApps: externalApps2, views: views2, inlineViews: inlineViews2, heldPids, themes: themes2, agentVersions: agentVersions2, sleeper: sleeper2, machines, stopHost, activity: activity2 } = {}) {
+function createRpcHandler(mgr2, adapters2, { terminals: terminals2, updates: updates2, commands, externalApps: externalApps2, views: views2, inlineViews: inlineViews2, heldPids, themes: themes2, agentVersions: agentVersions2, sleeper: sleeper2, machines, stopHost, activity: activity2, updateApply: updateApply2 } = {}) {
   const requireThemes = () => {
     if (!themes2) throw Object.assign(new Error("Theme files are unavailable"), { code: "internal" });
     return themes2;
@@ -116136,8 +117370,8 @@ function createRpcHandler(mgr2, adapters2, { terminals: terminals2, updates: upd
     "agents.resumeSession": async (p) => mgr2.resumeSession(RpcMethods["agents.resumeSession"].params.parse(p).sessionId),
     "agents.forkConversation": async (p) => mgr2.forkConversation(RpcMethods["agents.forkConversation"].params.parse(p).sessionId),
     "agents.updateSettings": async (p) => {
-      const { sessionId, ...settings } = RpcMethods["agents.updateSettings"].params.parse(p);
-      return await mgr2.updateSettings(sessionId, settings);
+      const { sessionId, by, ...settings } = RpcMethods["agents.updateSettings"].params.parse(p);
+      return await mgr2.updateSettings(sessionId, settings, by ?? "person");
     },
     "agents.switchTool": async (p) => {
       const { sessionId, tool } = RpcMethods["agents.switchTool"].params.parse(p);
@@ -116497,7 +117731,7 @@ function createRpcHandler(mgr2, adapters2, { terminals: terminals2, updates: upd
     },
     "projects.setTrusted": async (p) => {
       const { projectId, trusted } = RpcMethods["projects.setTrusted"].params.parse(p);
-      mgr2.setProjectTrusted(projectId, trusted);
+      void mgr2.setProjectTrusted(projectId, trusted).catch((err) => console.error("[sessions] restarting for a trust change failed:", err));
       externalApps2?.refresh();
       return { ok: true };
     },
@@ -116685,6 +117919,16 @@ function createRpcHandler(mgr2, adapters2, { terminals: terminals2, updates: upd
     // Answers once the install has started, not once it has finished — see the note on
     // `updates.apply` in the protocol. The rest arrives as `update_status` events.
     "updates.apply": async () => requireUpdates().apply(),
+    // A window's answer and report for an agent's "Apply now" (#665). Without the broker (tests) nothing is waiting
+    "updates.answerApply": async (p, ctx) => {
+      const a = RpcMethods["updates.answerApply"].params.parse(p);
+      return updateApply2 && ctx ? updateApply2.answer(ctx.client, a) : { ticket: null };
+    },
+    "updates.reportApply": async (p, ctx) => {
+      const r = RpcMethods["updates.reportApply"].params.parse(p);
+      if (updateApply2 && ctx) updateApply2.report(ctx.client, r);
+      return {};
+    },
     "host.stop": async () => {
       if (!stopHost) {
         throw Object.assign(new Error("This host runs under the Centralu app, which stops it: quit the app instead"), { code: "internal" });
@@ -116759,6 +118003,143 @@ function onExternalAppListChanged(apps, emit) {
   });
 }
 
+// packages/agent-host/src/update-apply.ts
+import { randomUUID as randomUUID11 } from "node:crypto";
+var ANSWER_MS = 5e3;
+var OUTCOME_MS = 2e4;
+var GONE_GRACE_MS = 5e3;
+var NO_WINDOW = "No Centralu window is open, so nothing was relaunched. The installed build starts the next time the person opens Centralu.";
+var WINDOW_GONE = "The window that was told to relaunch went away before it said it was relaunching, so whether it relaunched is not known. Look at Centralu.";
+var NO_ANSWER = "No Centralu window answered. A window of an older build cannot apply an update for an agent: ask the person to click Apply now on the update line.";
+var UpdateApplyBroker = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  probes = /* @__PURE__ */ new Map();
+  goes = /* @__PURE__ */ new Map();
+  /**
+   * The whole call: ask, then the caller's consent (null to go on, or why not), then ask again and relaunch one window.
+   * `consent` runs only when a window was ready, so "nothing installed" never raises a card.
+   */
+  async apply(consent) {
+    const first = await this.probe();
+    if (!first.ready) return { ok: false, error: first.error };
+    const refused = await consent();
+    if (refused) return { ok: false, error: refused };
+    const ready = await this.probe();
+    if (!ready.ready) return { ok: false, error: ready.error };
+    return this.go(ready);
+  }
+  /** Asks every window whether its "Apply now" could relaunch now; resolves with the first ready one */
+  probe() {
+    if (this.opts.windows() === 0) return Promise.resolve({ ready: false, error: NO_WINDOW });
+    const requestId = randomUUID11();
+    return new Promise((resolve12) => {
+      const p = {
+        requestId,
+        answered: /* @__PURE__ */ new Set(),
+        reasons: [],
+        finish: (r) => {
+          if (!this.probes.delete(requestId)) return;
+          clearTimeout(timer);
+          resolve12(r);
+        }
+      };
+      const timer = setTimeout(() => p.finish(this.notReady(p)), this.opts.answerMs ?? ANSWER_MS);
+      this.probes.set(requestId, p);
+      this.opts.push({ type: "update_apply_request", requestId });
+    });
+  }
+  /** `updates.answerApply`: a ticket for the first ready window of a request still waiting, null for every other */
+  answer(client, a) {
+    const p = this.probes.get(a.requestId);
+    if (!p || p.answered.has(client)) return { ticket: null };
+    p.answered.add(client);
+    if (a.ready) {
+      const ticket = randomUUID11();
+      p.finish({ ready: true, requestId: a.requestId, ticket, client, ...a.version ? { version: a.version } : {} });
+      return { ticket };
+    }
+    const reason = a.reason?.trim() || "That window cannot relaunch into the installed build.";
+    if (!p.reasons.includes(reason)) p.reasons.push(reason);
+    if (p.answered.size >= this.opts.windows()) p.finish(this.notReady(p));
+    return { ticket: null };
+  }
+  /**
+   * Tells the picked window to relaunch and waits for its outcome (#665 review). The window says "started" right before
+   * it relaunches; only after that does its connection ending count as the relaunch. Ending before it — a crash, a
+   * reload, a lost socket — is not a success: the window is given `goneGraceMs` to come back and report under the same
+   * ticket, then the answer says whether it relaunched is not known.
+   */
+  go(ready) {
+    return new Promise((resolve12) => {
+      const g5 = {
+        requestId: ready.requestId,
+        ticket: ready.ticket,
+        client: ready.client,
+        started: false,
+        ...ready.version ? { version: ready.version } : {},
+        finish: (o) => {
+          if (!this.goes.delete(ready.ticket)) return;
+          clearTimeout(timer);
+          clearTimeout(g5.grace);
+          resolve12(o);
+        }
+      };
+      const timer = setTimeout(
+        () => g5.finish({
+          ok: false,
+          error: g5.started ? "The window said it was relaunching but is still open. Look at Centralu to see whether it relaunched." : "The window was told to relaunch but did not say whether it did. Look at Centralu to see whether it relaunched."
+        }),
+        this.opts.outcomeMs ?? OUTCOME_MS
+      );
+      this.goes.set(ready.ticket, g5);
+      this.opts.push({ type: "update_apply_go", requestId: ready.requestId, ticket: ready.ticket });
+    });
+  }
+  /**
+   * `updates.reportApply`: the picked window's outcome. Matched by ticket, not by connection: only that window was given
+   * it, and a window that reconnected has a new connection number. A report naming another ticket, or a settled one, is
+   * dropped. The connection it came on is the one whose end is watched from then on.
+   */
+  report(client, r) {
+    const g5 = this.goes.get(r.ticket);
+    if (!g5 || g5.requestId !== r.requestId) return;
+    g5.client = client;
+    clearTimeout(g5.grace);
+    g5.grace = void 0;
+    if (r.error) return g5.finish({ ok: false, error: r.error });
+    if (r.started) {
+      g5.started = true;
+      return;
+    }
+    g5.finish(this.relaunched(g5));
+  }
+  /** A window's connection ended: after "started" that is the relaunch; before it, unknown; and one less to wait for */
+  clientGone(client) {
+    for (const g5 of [...this.goes.values()]) {
+      if (g5.client !== client) continue;
+      if (g5.started) {
+        g5.finish(this.relaunched(g5));
+        continue;
+      }
+      clearTimeout(g5.grace);
+      g5.grace = setTimeout(() => g5.finish({ ok: false, error: WINDOW_GONE }), this.opts.goneGraceMs ?? GONE_GRACE_MS);
+    }
+    for (const p of [...this.probes.values()]) {
+      if (p.answered.size >= this.opts.windows()) p.finish(this.notReady(p));
+    }
+  }
+  relaunched(g5) {
+    return { ok: true, ...g5.version ? { version: g5.version } : {} };
+  }
+  notReady(p) {
+    if (p.reasons.length === 0) return { ready: false, error: this.opts.windows() === 0 ? NO_WINDOW : NO_ANSWER };
+    return { ready: false, error: `Nothing was relaunched. ${p.reasons.join(" ")}` };
+  }
+};
+
 // packages/agent-host/src/app-change-events.ts
 var APP_CHANGE_WINDOW_MS = 250;
 function broadcastAppChanges(send, windowMs = APP_CHANGE_WINDOW_MS) {
@@ -117228,14 +118609,16 @@ var CommandRunner = class {
 };
 
 // packages/agent-host/src/updates.ts
-import { execFile as execFile8 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
+import { execFile as execFile8, execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync21, readFileSync as readFileSync13 } from "node:fs";
+import { join as join31 } from "node:path";
 var REGISTRY_URL = `https://registry.npmjs.org/${APP_SLUG}/latest`;
 var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
 var SCHEDULED_TIMEOUT_MS = 3e3;
 var FORCED_TIMEOUT_MS = 8e3;
 var INSTALL_CHECK_MAX_AGE_MS = 6e4;
 var STORED_RELEASE_MAX_AGE_MS = 60 * 60 * 1e3;
+var AUTO_RETRY_DELAYS_MS = [10 * 60 * 1e3, 60 * 60 * 1e3, 6 * 60 * 60 * 1e3];
 var INSTALL_TIMEOUT_MS = 5 * 60 * 1e3;
 var NPM_RETRY_DELAY_MS = 3e4;
 var NPM_RETRY_WINDOW_MS = 10 * 60 * 1e3;
@@ -117243,6 +118626,16 @@ function existingInstalledCopy() {
   const path2 = installedCopyPath();
   return existsSync21(path2) ? path2 : null;
 }
+function readInstalledCopyVersion(copy, platform = HOST_PLATFORM) {
+  const source = installedCopyVersionSource(copy, platform);
+  if (!source) return null;
+  try {
+    const text2 = source.kind === "command" ? execFileSync4(source.file, source.args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3, windowsHide: true }) : readFileSync13(join31(copy, source.name), "utf8");
+    return text2.trim() || null;
+  } catch {
+    return null;
+  }
+}
 async function fetchLatestFromRegistry(timeoutMs) {
   try {
     const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(timeoutMs) });
@@ -117282,7 +118675,13 @@ var UpdateService = class {
       fetchLatest: deps.fetchLatest ?? fetchLatestFromRegistry,
       run: deps.run ?? runCommand,
       installedCopy: deps.installedCopy ?? existingInstalledCopy,
+      installedCopyVersion: deps.installedCopyVersion ?? ((copy) => readInstalledCopyVersion(copy)),
       now: deps.now ?? Date.now,
+      schedule: deps.schedule ?? ((fn2, ms3) => {
+        const t = setTimeout(fn2, ms3);
+        t.unref?.();
+        return () => clearTimeout(t);
+      }),
       // If no place to persist it is given, treat auto-update as on — the same default that main.ts
       // passes in.
       readAuto: deps.readAuto ?? (() => true),
@@ -117322,6 +118721,10 @@ var UpdateService = class {
   deps;
   /** One check at a time — the timer and the button can land together */
   inFlight = null;
+  /** The last failed install: which version, how many times in a row, and when (#645) */
+  retry = null;
+  /** Cancels the automatic retry timer, while one is pending */
+  retryTimer = null;
   current() {
     return { ...this.status };
   }
@@ -117342,6 +118745,7 @@ var UpdateService = class {
   stop() {
     this.stopped = true;
     this.stopTimer();
+    this.cancelRetry();
   }
   stopTimer() {
     if (this.timer) clearInterval(this.timer);
@@ -117385,13 +118789,46 @@ var UpdateService = class {
     this.deps.writeAutoApply(enabled);
     this.emit();
     if (enabled) this.installIfAutomatic();
+    else this.cancelRetry();
     return this.current();
   }
-  /** With `autoApply` on and a newer version known, install it — once, not over an install or a finished one */
+  /**
+   * With `autoApply` on and a newer version known, install it — once, not over an install or a
+   * finished one. A failed install is tried again, but only on the backoff (#645): a check that
+   * lands right after the failure does not start another `npm i -g`, and one after the delay does,
+   * whether the retry timer or a person's Check now brought it.
+   */
   installIfAutomatic() {
     if (!this.status.autoApply || !this.status.newer || !this.status.latest) return;
-    if (this.status.phase !== "idle") return;
-    this.apply();
+    if (this.status.phase === "idle") {
+      void this.apply();
+      return;
+    }
+    if (this.status.phase !== "failed") return;
+    if (this.retryDue()) void this.apply();
+    else if (!this.retryTimer) this.scheduleRetry();
+  }
+  /**
+   * A failed install may be retried once its backoff has passed — or at once for a release that
+   * is not the one that failed: a new version is a new situation, and one attempt at it is cheap.
+   */
+  retryDue() {
+    if (!this.retry || this.retry.version !== this.status.latest) return true;
+    return this.deps.now() - this.retry.at >= retryDelay(this.retry.failures);
+  }
+  scheduleRetry() {
+    this.cancelRetry();
+    if (this.stopped || !this.retry || !this.status.autoApply || this.status.phase !== "failed") return;
+    const delay = Math.max(0, retryDelay(this.retry.failures) - (this.deps.now() - this.retry.at));
+    this.retryTimer = this.deps.schedule(() => {
+      this.retryTimer = null;
+      if (this.stopped || !this.status.autoApply || this.status.phase !== "failed" || !this.status.newer || !this.status.latest) return;
+      void this.apply();
+    }, delay);
+  }
+  cancelRetry() {
+    this.retryTimer?.();
+    this.retryTimer = null;
   }
   /**
    * Look at the registry, or answer with what we already know.
@@ -117441,63 +118878,94 @@ var UpdateService = class {
    * Install the newer version, then say so. **Does not restart the app** — that is the
    * window's step (#352).
    *
-   * Returns the moment the work starts. `npm i -g` regularly takes longer than the RPC
-   * deadline, and a caller that has already given up cannot be told how it went; the
-   * rest of the story arrives as `update_status` events.
+   * Answers once the target is settled: after the fresh lookup (at most the forced deadline, plus
+   * an older check it waits for), when `npm i -g` is about to start, or when the registry shows
+   * nothing newer. Not when the install is done — `npm i -g` regularly takes longer than the RPC
+   * deadline, and a caller that has already given up cannot be told how it went; the rest of the
+   * story arrives as `update_status` events.
+   *
+   * With nothing newer known it refreshes first rather than refusing (#645): the stored answer
+   * may be hours old, or there may be none at all with automatic checks off. "Up to date" is then
+   * a result (`idle`, no error), never `failed` — a refusal recorded as a failure stayed on the
+   * line through every later check.
    */
   apply() {
-    if (this.stopped || this.installing || this.status.phase === "restart_required") return this.current();
-    const latest = this.status.latest;
-    if (!this.status.newer || !latest) {
-      this.status = { ...this.status, phase: "failed", error: "There is no newer version to install" };
-      this.emit();
-      return this.current();
-    }
+    if (this.stopped || this.installing || this.status.phase === "restart_required") return Promise.resolve(this.current());
     this.installing = true;
-    this.status = { ...this.status, phase: "updating", error: null };
+    this.cancelRetry();
+    const known = this.status.newer && this.status.latest ? this.status.latest : null;
+    this.status = { ...this.status, phase: known ? "updating" : "checking", error: null };
     this.emit();
-    void this.runApply(latest);
-    return this.current();
+    return new Promise((settled) => void this.runApply(known, settled));
   }
-  async runApply(version2) {
+  async runApply(known, settled) {
+    let version2 = known;
     let packageInstalled = false;
+    let answered = false;
+    const answer = () => {
+      if (answered) return;
+      answered = true;
+      settled(this.current());
+    };
     const copy = this.deps.installedCopy();
     try {
       await this.inFlight;
       if (this.stopped) return;
       const age2 = this.status.checkedAt === null ? Infinity : this.deps.now() - this.status.checkedAt;
-      if (age2 < 0 || age2 >= INSTALL_CHECK_MAX_AGE_MS) {
+      if (version2 === null || age2 < 0 || age2 >= INSTALL_CHECK_MAX_AGE_MS) {
         const fresh = await this.deps.fetchLatest(FORCED_TIMEOUT_MS);
         if (this.stopped) return;
         if (fresh.ok) {
           const now = this.deps.now();
           const storedAge = this.status.checkedAt === null ? Infinity : now - this.status.checkedAt;
-          const keepStored = storedAge >= 0 && storedAge < STORED_RELEASE_MAX_AGE_MS && isNewerVersion(version2, fresh.version);
-          if (!keepStored) version2 = fresh.version;
-          this.status = { ...this.status, latest: version2, newer: isNewerVersion(version2, this.status.current), checkedAt: keepStored ? this.status.checkedAt : now };
+          const keepStored = version2 !== null && storedAge >= 0 && storedAge < STORED_RELEASE_MAX_AGE_MS && isNewerVersion(version2, fresh.version);
+          const target = keepStored && version2 !== null ? version2 : fresh.version;
+          version2 = target;
+          this.status = { ...this.status, latest: target, newer: isNewerVersion(target, this.status.current), checkedAt: keepStored ? this.status.checkedAt : now };
           if (!this.status.newer) {
             this.status = { ...this.status, phase: "idle", error: null };
             return;
           }
+        } else if (version2 === null) {
+          this.status = { ...this.status, phase: "idle", error: fresh.reason };
+          return;
         } else {
           this.status = { ...this.status, error: `Could not refresh latest (${fresh.reason}); using previously checked ${version2}.` };
         }
       }
+      if (version2 === null) return;
+      this.status = { ...this.status, phase: "updating" };
       this.emit();
+      answer();
       await this.installPackage(version2);
       if (this.stopped) return;
       packageInstalled = true;
-      if (copy) await this.deps.run(APP_SLUG, ["install"]);
+      if (copy) {
+        const copyVersion = this.deps.installedCopyVersion(copy);
+        if (keepsInstalledCopy(version2, copyVersion)) {
+          const notice = `The local build ${copyVersion} at ${copy} is newer than ${version2} and was kept.`;
+          this.status = { ...this.status, error: this.status.error ? `${this.status.error} ${notice}` : notice };
+        } else {
+          await this.deps.run(APP_SLUG, ["install"]);
+        }
+      }
       if (this.stopped) return;
       this.status = { ...this.status, phase: "restart_required" };
+      this.retry = null;
     } catch (e) {
       if (this.stopped) return;
       const reason = e.message;
       const error51 = packageInstalled ? `npm installed ${version2}, but the copy at ${copy} was not replaced (${reason}). Quit ${APP_NAME}, then run "${APP_SLUG} install" in a terminal.` : reason;
       this.status = { ...this.status, phase: "failed", error: error51 };
+      const target = version2 ?? this.status.latest ?? "";
+      this.retry = { version: target, failures: this.retry?.version === target ? this.retry.failures + 1 : 1, at: this.deps.now() };
     } finally {
       this.installing = false;
-      if (!this.stopped) this.emit();
+      if (!this.stopped) {
+        this.emit();
+        if (this.status.phase === "failed") this.installIfAutomatic();
+      }
+      answer();
     }
   }
   /**
@@ -117537,6 +119005,9 @@ var UpdateService = class {
 function npmHasNotServedVersion(err) {
   return /(?:\bETARGET\b|\bnotarget\b)/i.test(err instanceof Error ? err.message : String(err));
 }
+function retryDelay(failures) {
+  return AUTO_RETRY_DELAYS_MS[Math.min(Math.max(failures, 1), AUTO_RETRY_DELAYS_MS.length) - 1];
+}
 
 // packages/agent-host/src/agent-versions.ts
 var CHECK_INTERVAL_MS2 = 10 * 60 * 1e3;
@@ -117879,16 +119350,16 @@ var SessionSleeper = class {
 };
 
 // packages/agent-host/src/dev-services/instance-lock.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { readFileSync as readFileSync13, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname10, join as join31 } from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { readFileSync as readFileSync14, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname11, join as join32 } from "node:path";
 import Database2 from "better-sqlite3";
 var OWNERSHIP_FILE = "host-ownership.sqlite";
 var held = /* @__PURE__ */ new Set();
 function processStartTime(pid) {
   if (!hasPs()) return null;
   try {
-    const out = execFileSync4("ps", ["-o", "lstart=", "-p", String(pid)], {
+    const out = execFileSync5("ps", ["-o", "lstart=", "-p", String(pid)], {
       encoding: "utf8",
       timeout: 2e3,
       stdio: ["ignore", "pipe", "ignore"],
@@ -117915,15 +119386,15 @@ function parseHolder(raw) {
 function acquireInstanceLock(dbPath2, startOf = processStartTime) {
   if (dbPath2 === ":memory:") return { ok: true, release: () => {
   } };
-  const lockPath = join31(dirname10(dbPath2), "host.lock");
+  const lockPath = join32(dirname11(dbPath2), "host.lock");
   const readHolder = () => {
     try {
-      return parseHolder(readFileSync13(lockPath, "utf8"));
+      return parseHolder(readFileSync14(lockPath, "utf8"));
     } catch {
       return null;
     }
   };
-  const owner = takeOwnership(join31(dirname10(dbPath2), OWNERSHIP_FILE));
+  const owner = takeOwnership(join32(dirname11(dbPath2), OWNERSHIP_FILE));
   if (!owner) {
     const holder = readHolder();
     return { ok: false, heldByPid: holder && Number.isInteger(holder.pid) && holder.pid > 0 ? holder.pid : null, lockPath };
@@ -117936,7 +119407,7 @@ function acquireInstanceLock(dbPath2, startOf = processStartTime) {
       if (released) return;
       released = true;
       try {
-        if (parseHolder(readFileSync13(lockPath, "utf8")).pid === process.pid) unlinkSync3(lockPath);
+        if (parseHolder(readFileSync14(lockPath, "utf8")).pid === process.pid) unlinkSync3(lockPath);
       } catch {
       }
       giveUp(owner);
@@ -118351,7 +119822,7 @@ async function runDrain(bound, deps) {
 }
 
 // packages/agent-host/src/links/install.ts
-import { existsSync as existsSync22, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync15 } from "node:fs";
 import { hostname as hostname3 } from "node:os";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { gzipSync } from "node:zlib";
@@ -119029,7 +120500,7 @@ async function installRemote(o) {
 function bundled(name, source) {
   for (const url2 of [new URL(`./${name}`, import.meta.url), new URL(source, import.meta.url)]) {
     const file2 = fileURLToPath6(url2);
-    if (existsSync22(file2)) return readFileSync14(file2, "utf8");
+    if (existsSync22(file2)) return readFileSync15(file2, "utf8");
   }
   throw new Error(`${name} is missing from this host`);
 }
@@ -119156,9 +120627,9 @@ function probeTarget(target, opts = {}) {
 
 // packages/agent-host/src/links/ssh-config.ts
 import { spawn as spawn8 } from "node:child_process";
-import { readdirSync as readdirSync8, readFileSync as readFileSync15, statSync as statSync13 } from "node:fs";
+import { readdirSync as readdirSync8, readFileSync as readFileSync16, statSync as statSync13 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import { isAbsolute as isAbsolute10, join as join32, normalize, parse as parse6, sep as sep12 } from "node:path";
+import { isAbsolute as isAbsolute10, join as join33, normalize, parse as parse6, sep as sep12 } from "node:path";
 var MAX_DEPTH2 = 16;
 function splitConfigLine(raw) {
   const m = /^\s*([^\s=#]+)\s*(?:=\s*)?([\s\S]*)$/.exec(raw);
@@ -119224,7 +120695,7 @@ function expandGlob(path2) {
     const next = [];
     for (const base2 of found) {
       if (!MAGIC.test(seg)) {
-        next.push(join32(base2, seg));
+        next.push(join33(base2, seg));
         continue;
       }
       let names;
@@ -119236,7 +120707,7 @@ function expandGlob(path2) {
       const re2 = segmentRe(seg);
       for (const name of names.sort()) {
         if (name.startsWith(".") && !seg.startsWith(".")) continue;
-        if (re2.test(name)) next.push(join32(base2, name));
+        if (re2.test(name)) next.push(join33(base2, name));
       }
     }
     found = next;
@@ -119266,7 +120737,7 @@ function readSshConfig(opts) {
     }
     let text2;
     try {
-      text2 = readFileSync15(file2, "utf8");
+      text2 = readFileSync16(file2, "utf8");
     } catch (err) {
       if (depth > 0 && err.code !== "ENOENT") notes.push(`${tildePath(file2, opts.home)} could not be read`);
       return;
@@ -119291,11 +120762,11 @@ function readSshConfig(opts) {
         }
         for (const arg of split2.args) {
           let path2 = arg;
-          if (path2.startsWith("~/")) path2 = join32(opts.home, path2.slice(2));
+          if (path2.startsWith("~/")) path2 = join33(opts.home, path2.slice(2));
           else if (path2.startsWith("~")) {
             notes.push(`An Include of another user's folder (${where(file2, n + 1)}) was not read`);
             continue;
-          } else if (!isAbsolute10(path2)) path2 = join32(opts.home, ".ssh", path2);
+          } else if (!isAbsolute10(path2)) path2 = join33(opts.home, ".ssh", path2);
           for (const f of expandGlob(path2)) read(f, depth + 1);
         }
       }
@@ -119345,7 +120816,7 @@ var MAX_HOSTS = 100;
 var RESOLVE_AT_ONCE = 8;
 async function listSshHosts(opts = {}) {
   const home = opts.home ?? homedir13();
-  const file2 = opts.configFile ?? join32(home, ".ssh", "config");
+  const file2 = opts.configFile ?? join33(home, ".ssh", "config");
   const read = readSshConfig({ file: file2, home });
   const notes = [...read.notes];
   const listed = read.hosts.slice(0, MAX_HOSTS);
@@ -119708,7 +121179,10 @@ var Qualifier = class {
     const sid = typeof e.sessionId === "string" ? this.id(e.sessionId) : void 0;
     const base2 = { ...e, ...sid !== void 0 ? { sessionId: sid } : {} };
     switch (e.type) {
+      // Another machine's agent asking its own windows to apply (#665) must never relaunch the hub's window
       case "update_status":
+      case "update_apply_request":
+      case "update_apply_go":
       case "themes_changed":
       case "app_state_changed":
       case "agent_versions":
@@ -120733,7 +122207,7 @@ function linkedSessions(machines, route = notRouted, hubName2) {
     async updateSettings(sessionId, s) {
       const m = owner(sessionId);
       if (!m) return { ok: false, error: `Not a session of a linked machine: ${sessionId}` };
-      return attempt(m, async () => ({ info: await route("agents.updateSettings", { sessionId, ...s }) }));
+      return attempt(m, async () => ({ info: await route("agents.updateSettings", { sessionId, ...s, by: "orchestrator" }) }));
     },
     async findProjects(ref) {
       const wanted = ref.trim();
@@ -121128,6 +122602,9 @@ var ROUTES = {
   "updates.setAuto": HUB,
   "updates.setAutoApply": HUB,
   "updates.apply": HUB,
+  // The hub's own windows answer the hub's own host (#665); a linked machine's events never ask them
+  "updates.answerApply": HUB,
+  "updates.reportApply": HUB,
   "machines.list": HUB,
   "machines.add": HUB,
   "machines.sshHosts": HUB,
@@ -121451,7 +122928,7 @@ function storeMirror(store2) {
 var start = new StartSequence();
 start.at("launch variables");
 var launch = takeLaunchEnv();
-var BUILD = true ? "8dd78b6" : "dev";
+var BUILD = true ? "29ffab5" : "dev";
 var { values } = parseArgs({
   options: {
     port: { type: "string", default: "5175" },
@@ -121472,17 +122949,17 @@ start.at("data folder");
 var movedNote = null;
 function defaultDbPath() {
   const isDev = process.env.CC_DEV === "1";
-  const dir = join33(homedir14(), isDev ? DATA_DIR_DEV : DATA_DIR);
-  const legacy = join33(homedir14(), isDev ? DATA_DIR_LEGACY.dev : DATA_DIR_LEGACY.prod);
+  const dir = join34(homedir14(), isDev ? DATA_DIR_DEV : DATA_DIR);
+  const legacy = join34(homedir14(), isDev ? DATA_DIR_LEGACY.dev : DATA_DIR_LEGACY.prod);
   movedNote = migrateLegacyDataDir(legacy, dir) ? `[agent-host] data folder moved: ${legacy} -> ${dir}` : null;
   mkdirSync11(dir, { recursive: true });
   process.env.CC_DATA_DIR = dir;
-  return join33(dir, "store.db");
+  return join34(dir, "store.db");
 }
 var dbPath = values.memory ? ":memory:" : values.db ?? defaultDbPath();
 start.at("log");
 var stopLog = dbPath === ":memory:" ? () => {
-} : teeStderrToFile(hostLogPath(dirname11(dbPath)));
+} : teeStderrToFile(hostLogPath(dirname12(dbPath)));
 if (dbPath !== ":memory:") console.error(startupBanner({ build: BUILD, db: dbPath, pid: process.pid }));
 if (movedNote) console.error(movedNote);
 start.at("path");
@@ -121538,7 +123015,7 @@ try {
 }
 var adapters = createAdapters();
 start.at("keeper children");
-var held2 = launch.underKeeper ? await connectHeldChildren(dirname11(dbPath)) : null;
+var held2 = launch.underKeeper ? await connectHeldChildren(dirname12(dbPath)) : null;
 start.at("services");
 var screens = new Gate();
 var events = new Gate();
@@ -121555,7 +123032,7 @@ var mgr = new SessionManager(
   },
   (sessionId) => bridgeAddress(launch.frontDoor, port, token, sessionId),
   // Worktrees are created next to the data folder — dev and the packaged app never touch each other's worktrees
-  join33(dirname11(dbPath), "worktrees"),
+  join34(dirname12(dbPath), "worktrees"),
   held2 ? { processes: held2.processes, keptSessions: held2.kept.sessionIds } : {}
 );
 mgr.useProjectsHome(() => projectsHome());
@@ -121589,7 +123066,7 @@ if (held2) {
 }
 var AUTO_UPDATE_CHECK_KEY = "updates.auto";
 var AUTO_APPLY_UPDATES_KEY = "updates.autoApply";
-var themes = new ThemeFiles(join33(dataRoot(), "themes"), () => events.push({ type: "themes_changed" }));
+var themes = new ThemeFiles(join34(dataRoot(), "themes"), () => events.push({ type: "themes_changed" }));
 await themes.start().catch((e) => console.error(`[themes] the themes folder is unavailable: ${e.message}`));
 var updates = new UpdateService((status) => events.push({ type: "update_status", status }), {
   // On by default when nothing has been saved yet. Since the check is read-only and every failure
@@ -121603,6 +123080,8 @@ var updates = new UpdateService((status) => events.push({ type: "update_status",
   writeAutoApply: (enabled) => store.setAppSetting(AUTO_APPLY_UPDATES_KEY, String(enabled))
 });
 mgr.useUpdates(updates);
+var updateApply = new UpdateApplyBroker({ push: (e) => events.push(e), windows: () => server.clientCount });
+mgr.useUpdateApply(updateApply);
 var AUTO_APPLY_AGENT_VERSIONS_KEY = "agents.autoApplyVersions";
 var AGENT_VERSIONS_SEEN_KEY = "agents.versionsSeen";
 var agentVersions = new AgentVersionService({
@@ -121710,7 +123189,8 @@ var router = new Router({
     heldPids: held2?.heldPids,
     machines: links,
     stopHost: launch.startedByServe && !launch.underKeeper ? () => stopFromRequest() : void 0,
-    activity: () => activityCounts(activity())
+    activity: () => activityCounts(activity()),
+    updateApply
   }),
   machines: () => links.all()
 });
@@ -121721,7 +123201,10 @@ var server = new HostServer({
   allowedOrigins,
   onRpc: router.handle,
   // A window's connection ended: the pinned views it leased wait for a claim, then close (#392, view-host.ts)
-  onClientGone: (client) => views.holderGone(client),
+  onClientGone: (client) => {
+    views.holderGone(client);
+    updateApply.clientGone(client);
+  },
   // Every HTTP route sits behind this secret (transport/http.ts)
   http: { secret: httpSecret, routes: views.routes },
   // Which build this is and where it came from, in every hello_ok (#280, keeper-link.ts)
@@ -121808,7 +123291,7 @@ var endings = wireEndings({
   heldChildren: held2 !== null,
   leave: (mode, handOver) => void shutdown.leave(mode, handOver),
   force: (why) => shutdown.force(why),
-  record: crashRecorder(join33(dirname11(dbPath), "host-errors.log"), (line) => console.error(line)),
+  record: crashRecorder(join34(dirname12(dbPath), "host-errors.log"), (line) => console.error(line)),
   stdin: process.stdin,
   watchParent: values["watch-parent"] === true,
   log: (line) => console.error(line)